Stolen UpdraftCentral Keys Bring WordPress Backdoor Risks Into Focus

🔍 Read the full analysis: Stolen UpdraftCentral Keys Bring WordPress Backdoor Risks Into Focus on ThorstenMeyerAI.com

Attackers used stolen UpdraftCentral Cloud connection keys to install backdoor plugins on WordPress sites, TeamUpdraft said after disclosing a breach on October 19, 2026. The incident matters because the commands were accepted by the plugin’s normal authentication checks, and updating UpdraftPlus does not remove a backdoor already placed on a site.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said attackers accessed its teamupdraft.com website over the weekend of October 17 and 18 and that it believes they reached its customer database. The database included customer names, email addresses, billing addresses, order histories, hashed account passwords, two-factor authentication settings and keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment-card data; Stripe and PayPal process payments.

TeamUpdraft said the UpdraftPlus plugin, its downloads and self-hosted UpdraftCentral were not affected. It released UpdraftPlus versions 1.26.13 and 2.26.13 for free and Premium users to revoke exposed keys. The company said it closed the access route, signed out accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also reported the incident to the UK Information Commissioner’s Office.

Security firms reported that attackers used legitimate signed commands to upload and activate plugins. Patchstack counted 99 plugin names in installations it examined between the afternoon of October 18 and 09:23 the next day. One recurring plugin description was “Small maintenance toolkit: keeps option storage tidy.” The installed backdoors could create accounts with elevated capabilities and provide access through a persistent cookie, according to Patchstack and Nethemba.

Why Exposed Keys Could Control Sites

UpdraftCentral Cloud lets site owners manage multiple WordPress installations through a hosted dashboard. When a site is connected, its UpdraftPlus client accepts commands signed with the associated connection key. That design means a stolen, valid key can authorize actions such as plugin installation without exploiting a software flaw in the site itself.

Patchstack said the commands in the attacks were correctly encrypted and signed with genuine dashboard keys, so the plugin’s checks passed. As a result, researchers said fully patched sites could still be affected. This distinction matters to site owners: applying a software update can stop some exposed credentials from working, but it is not a substitute for checking whether an attacker already installed a plugin or created an account.

The scale of the impact is not known. TeamUpdraft has not said how many customers or WordPress sites were affected. The incident also exposes risks for administrators who may not realize they enabled remote management: the source material says the option to add a website to UpdraftCentral is selected by default when connecting a TeamUpdraft account.

How the Remote Keys Were Exposed

UpdraftPlus includes a client for UpdraftCentral, which remains dormant until a connection key is set. According to the supplied incident reporting, commands then run with the permissions of the user who created the key. Researchers said keys did not expire, and Nethemba observed keys created in November 2025 being used after the October 2026 breach.

Nethemba said it found the attack on three of its own sites and traced the activity to keys used from the attacker’s server. The firm said its analysis ruled out a modified plugin, weak cryptography and the earlier key-forgery vulnerability CVE-2026-10795, which was fixed in version 1.26.5 in June 2026. The available source describes this as a second serious incident involving this channel in five months, but does not provide further detail about the earlier incident.

TeamUpdraft released version 1.26.12 on October 19 to revoke keys created before the incident. Nethemba reported that a bug meant that release deleted no keys. Version 1.26.13 followed the same evening. Nethemba said the new release deletes keys created before 12:07 UTC on October 18; keys created from 12:07 to 21:00 UTC that day were not removed by the update and require manual deletion, according to its analysis.

““Properly apply the revocation in 1.26.12.””

— TeamUpdraft

Affected Accounts and Sites Unknown

The number of affected customers and websites has not been disclosed, and the source material does not establish how many backdoors remain active. It is also unclear which individual customers’ information was accessed or whether attackers used every type of key in the database. TeamUpdraft said it believes attackers reached the customer database, but the full scope of access remains under investigation.

The key-revocation window also needs careful checking. Nethemba’s review says version 1.26.13 removes keys created before 12:07 UTC on October 18, while keys created later that day through 21:00 UTC require manual deletion. The supplied material says TeamUpdraft gave a 22:00 BST cutoff, equivalent to 21:00 UTC. Site owners should consult the current vendor advisory and researchers’ updates for instructions that match their key creation times.

Researchers reported that backdoor variants differ: some hide from the plugin list, and one early variant can cause HTTP 500 errors before checking for its activation token. Removing or repairing a visibly broken plugin may not be enough. The full set of variants and the most current cleanup guidance remain subject to change as analysis continues.

Check Keys and Inspect Sites

TeamUpdraft has advised users to follow its current security notice, while Patchstack and Nethemba have published technical analyses and indicators for identifying the malicious plugins. Administrators should update to the applicable fixed UpdraftPlus release, review whether their site was connected to UpdraftCentral, and check the vendor’s current instructions for revoking keys, including keys that may fall outside the automated cutoff.

Sites where a suspicious plugin or unauthorized account is found need separate incident response: the update does not remove installed backdoors or accounts. TeamUpdraft also recommends re-authorizing external storage and rotating its access keys if UpdraftCentral was used to access the site. Owners should check the latest vendor and researcher guidance as the investigation develops; the available source does not give a date for a final incident report.

Key Questions

What happened in the UpdraftCentral breach?

TeamUpdraft said attackers accessed its website and likely reached a customer database containing UpdraftCentral connection keys. Researchers reported that stolen keys were used to install backdoor plugins on WordPress sites.

Does updating UpdraftPlus remove a backdoor?

No. The supplied advisories say the update revokes some exposed keys, but it does not remove a malicious plugin or an unauthorized account already installed on a site.

Which UpdraftPlus versions contain the key revocation fix?

TeamUpdraft released version 1.26.13 for the free plugin and 2.26.13 for Premium users. Nethemba reported that keys created during part of October 18 still require manual deletion, so users should check current vendor guidance.

Was payment-card information exposed?

TeamUpdraft said it did not store card data and that Stripe and PayPal handle payments. The database did contain personal and account information, including names, email and billing addresses, order histories, hashed passwords and two-factor authentication settings.

Were backups in Google Drive, Dropbox or Amazon S3 affected?

The source material says backups stored in customers’ own storage accounts were not affected. TeamUpdraft recommends re-authorizing that storage and rotating access keys if UpdraftCentral was used to access the site.

Source: ThorstenMeyerAI.com