A WordPress Backdoor Risk Emerges From Stolen UpdraftCentral Keys

🔍 Read the full analysis: A WordPress Backdoor Risk Emerges From Stolen UpdraftCentral Keys on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft said on October 19, 2026, that attackers had accessed its website and likely reached a customer database containing UpdraftCentral Cloud connection keys; security researchers say the keys were used to install backdoor plugins on WordPress sites. The incident matters because a valid key lets the hosted dashboard issue commands to a connected site, so updating UpdraftPlus alone may not remove an existing compromise.

According to TeamUpdraft’s incident post, the attackers accessed teamupdraft.com over the weekend of October 17–18. The company believes they reached a database holding customer names, email and billing addresses, order history, password hashes, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft said it did not store payment-card data; Stripe and PayPal process payments.

Patchstack’s analysis found that attackers used the keys to send a command to upload a plugin, which WordPress then installed and activated. Patchstack counted 99 plugin names used in installations between the afternoon of October 18 and 09:23 on October 19. Names included “Site Health Cache,” “Seo Helper,” “Wp Forge” and “Js Clean.” A recurring description researchers identified was: “Small maintenance toolkit: keeps option storage tidy.”

TeamUpdraft released UpdraftPlus 1.26.13 for the free version and 2.26.13 for Premium to revoke exposed keys. The company said the plugin itself, its downloads and self-hosted UpdraftCentral were not affected. However, researchers say the revocation has limits: it does not remove malicious plugins or accounts already placed on a site, and some keys may need to be deleted manually.

A Valid Key Can Control a Site

The incident shows how a stolen management credential can put a site at risk without exploiting a flaw in its current plugin software. Patchstack said the commands were signed with genuine dashboard keys, so the client accepted them as authorized. Researchers reported affected sites running current software, meaning a routine plugin update may not prevent or reverse this type of access.

According to the researchers’ analysis, the installed backdoor could create an account, grant it elevated capabilities, and provide a persistent login that bypasses the normal login form. The account may remain after the malicious plugin is removed, and some plugin variants hide from the site’s plugin list. That makes site inspection and account review necessary in addition to updating and revoking keys.

For site owners, the reach of the incident depends on whether a site was connected to UpdraftCentral Cloud and whether its key was exposed or used. TeamUpdraft has not published a count of affected customers or sites, so the overall scale is not yet known.

How the Dashboard Connection Works

UpdraftPlus includes an UpdraftCentral client that can remain inactive until a site is connected using a key. Once connected, it can accept commands signed with that key, with permissions tied to the user who created it. Nethemba reported that connecting a TeamUpdraft account in UpdraftPlus may enable the “Add this website to UpdraftCentral” option by default; the firm said the Premium version behaves similarly.

Nethemba said it found the attack on three of its own sites and traced the activity to keys used from an attacker’s server. It reported that keys did not expire and identified keys created in November 2025 being used after the breach. Nethemba said its investigation did not point to a modified plugin, weak cryptography or the older forgery vulnerability CVE-2026-10795, which it said was fixed in version 1.26.5 in June.

The first fix, UpdraftPlus 1.26.12, was released October 19 to revoke older UpdraftCentral Cloud keys. Nethemba said a bug meant that version deleted no keys. Version 1.26.13 followed the same evening. Nethemba’s code review says it removes keys created before 12:07 UTC on October 18, while keys created between that time and 21:00 UTC may remain and require manual deletion. TeamUpdraft’s stated cutoff was 22:00 British Summer Time, equivalent to 21:00 UTC.

“The company said it believes attackers reached its customer database.”

— TeamUpdraft

Affected Sites and Keys Remain Uncounted

TeamUpdraft has not said how many customers, keys or WordPress sites were affected, nor published a complete account of how the attackers gained access to the website. It said it believes the customer database was reached, but the full extent of data access remains unclear.

The key revocation does not cover every possible connection. Nethemba reported a gap between the cutoff stated by TeamUpdraft and the time covered by the code in version 1.26.13. Site owners may not know when a connection key was created, and connections made after the cutoff are not revoked by this process. The vendor and researchers have also warned that cleanup advice may change as additional backdoor variants are identified.

TeamUpdraft said backups stored in customers’ own services, such as Google Drive, Dropbox or Amazon S3, were not affected. It nevertheless recommends reauthorizing those storage connections and rotating access keys if UpdraftCentral was used to manage the site.

Update, Revoke, Then Inspect

TeamUpdraft said it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys, and rotated keys with payment providers. It also said it reported the incident to the UK Information Commissioner’s Office. Site owners should follow the current TeamUpdraft advisory and the analyses from Patchstack and Nethemba, as their guidance may be updated.

For site administrators, the immediate steps are to update to the applicable fixed UpdraftPlus version, review and remove any exposed UpdraftCentral connections, and rotate relevant credentials. If a suspicious plugin or account is found, updating the plugin is not a cleanup procedure: researchers warn that the backdoor and its created account can persist independently. Treat a site where a backdoor is identified as compromised and investigate it fully, including administrator accounts, plugins and persistent access.

Further clarity depends on TeamUpdraft’s investigation and any updated advisories that identify affected records, key cutoffs or additional malicious variants. The company has not announced a final incident report or a timetable for one.

Key Questions

Does updating UpdraftPlus remove a backdoor?

No. The update is intended to revoke some exposed keys, but it does not remove a malicious plugin or account that may already have been installed on a site. Researchers advise checking the site separately and following current incident guidance.

Which UpdraftPlus versions did TeamUpdraft release?

TeamUpdraft released UpdraftPlus 1.26.13 for the free plugin and 2.26.13 for Premium. The company said these releases address key revocation; owners should consult its current advisory for version-specific instructions.

Were customer payment cards exposed?

TeamUpdraft said it did not store card data and that Stripe and PayPal handle payments. The company reported that the database included customer contact and billing details, order history, password hashes, two-factor settings and product connection keys.

Could a fully updated WordPress site still be affected?

Yes, according to Patchstack and Nethemba. Their findings describe attackers using valid, stolen dashboard keys to issue commands, rather than relying on a vulnerability in an outdated UpdraftPlus installation. Researchers reported that fully patched sites could be affected if connected with an exposed key.

What should I check if my site used UpdraftCentral Cloud?

Update the plugin, review and revoke relevant connections, rotate associated credentials, and inspect the site for unfamiliar plugins and accounts, including accounts with elevated capabilities. Follow the latest TeamUpdraft, Patchstack and Nethemba guidance; the full number of affected sites and keys remains unknown.

Source: ThorstenMeyerAI.com