Stolen Keys, Vulnerable Sites: The UpdraftCentral WordPress Fix Has A Gap

🔍 Read the full analysis: Stolen Keys, Vulnerable Sites: The UpdraftCentral WordPress Fix Has A Gap on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get hardware and tech essentials delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft confirmed on October 19 that attackers accessed its teamupdraft.com website and may have reached a customer database containing UpdraftCentral Cloud connection keys. Security researchers say those keys were used to install backdoor plugins on WordPress sites, while the latest UpdraftPlus update does not revoke every affected key or remove backdoors already installed.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said the incident involved access to its website over the weekend of October 17 and 18. The company believes attackers reached a customer database containing names, email and billing addresses, order histories, hashed account passwords, two-factor authentication settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft said it did not store payment card data; Stripe and PayPal process payments.

TeamUpdraft released UpdraftPlus 1.26.12 on October 19 to revoke UpdraftCentral Cloud keys created before the incident. Nethemba later reported that a bug in that release meant it did not delete any keys. TeamUpdraft followed with version 1.26.13, whose changelog said it properly applied the revocation. Nethemba’s code review says the corrected release removes keys created before 12:07 UTC on October 18, but not keys created from then until 21:00 UTC that day. Those keys, according to Nethemba, need to be deleted manually.

TeamUpdraft said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected. The company said it closed the access route, signed out accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also reported the incident to the UK Information Commissioner’s Office. The company has not disclosed how many customers or WordPress sites may be affected.

Why Exposed Keys Could Install Backdoors

The exposed keys matter because they let UpdraftCentral Cloud issue commands to connected WordPress sites. Patchstack’s analysis says sites accept commands signed with the genuine key, including commands to upload and activate a plugin. That means this attack did not require exploiting a flaw in an up-to-date copy of WordPress or UpdraftPlus: a site could pass its normal checks and still receive a malicious command authorized with a stolen key.

Patchstack counted 99 different plugin names installed between the afternoon of October 18 and 09:23 UTC on October 19. It identified “Site Health Cache” frequently, alongside names such as “Seo Helper,” “Wp Forge” and “Js Clean.” The researchers say the backdoor can create an account with elevated permissions and provide a persistent login cookie, allowing an attacker to bypass the usual login form. Removing the plugin alone may not remove the account it created.

This creates two separate security tasks for site owners: revoke exposed connections and check for signs that a site was already compromised. A software update addresses only part of the problem. Sites where a backdoor or unauthorized account is found should be treated as compromised, not as clean simply because the plugin has been updated or deleted.

How UpdraftCentral Connections Work

UpdraftPlus includes a client for UpdraftCentral, a dashboard used to manage multiple WordPress sites remotely. The client remains inactive until a connection key is supplied. Once connected, it can carry out commands with the permissions associated with the user who created the key. According to the source material, the setting to add a site to remote UpdraftCentral control is selected by default when a TeamUpdraft account is connected in UpdraftPlus settings. Nethemba says the Premium version behaves the same way.

Researchers also say the keys do not expire. Nethemba reported seeing keys created in November 2025 used after this breach. The firm said it found the attack on three of its own sites and traced the commands to the attacker’s server. It ruled out a modified plugin, weak cryptography and the older vulnerability CVE-2026-10795, which had been fixed in June in UpdraftPlus 1.26.5. The source describes this as a second serious incident involving this channel in five months.

Patchstack and Nethemba describe a backdoor that waits for a URL parameter containing a 32-character token. It can then create an account, commonly with a name resembling “data-ops43,” an example.org email address and the display name “Site Tools.” Some variants hide from the WordPress plugin list. Researchers warn that an early variant can cause HTTP 500 errors before reaching its token check; they advise removing the affected plugin rather than trying to repair it, since restoring normal operation may activate the backdoor.

“The UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected.”

— TeamUpdraft

Affected Sites and Keys Still Uncounted

The number of affected customers and sites remains unknown. TeamUpdraft has not published a count, and the source material does not establish how many exposed keys were used successfully. It is also not clear how many sites have backdoors that have not yet been detected.

Nethemba’s reported cutoff analysis identifies keys created between 12:07 and 21:00 UTC on October 18 as not removed by version 1.26.13. The source says TeamUpdraft’s stated cutoff was 22:00 BST, equivalent to 21:00 UTC. The precise key status on an individual site depends on when its connection was created and whether it was used; owners may need to check the vendor’s current advisory for instructions. Cleanup guidance may change as researchers identify additional backdoor variants.

TeamUpdraft says backups stored in customers’ own services, such as Google Drive, Dropbox or Amazon S3, were not affected. However, it recommends re-authorizing storage and rotating access keys if UpdraftCentral was used to access a site. The available information does not say whether any data in the customer database has been misused beyond the reported command activity.

Update, Revoke, Then Inspect Sites

Site owners using UpdraftPlus should install version 1.26.13 (or the corresponding Premium release, 2.26.13) and check TeamUpdraft’s latest incident advisory for key-revocation steps. Because some keys may require manual deletion, an update alone may not end every connection. Owners should also review whether UpdraftCentral was enabled, including through the default connection setting.

Separately, check for unfamiliar plugins and administrator-level access, including plugin names and accounts matching the indicators reported by Patchstack and Nethemba. If a suspicious plugin is found, follow the researchers’ current cleanup guidance rather than relying on the UpdraftPlus update to remove it. Treat a site with a detected backdoor as compromised and review connected storage credentials if UpdraftCentral had access.

Further clarification is needed from TeamUpdraft on the number of affected customers and sites and on the status of keys outside the corrected revocation window. Researchers may publish revised indicators or cleanup advice as additional variants are examined. Site owners should use current vendor and researcher guidance, since the investigation and remediation details are still developing.

Key Questions

What happened in the TeamUpdraft breach?

TeamUpdraft said attackers accessed teamupdraft.com over the weekend of October 17 and 18, 2026, and may have reached a customer database containing UpdraftCentral Cloud keys and customer information. Researchers say stolen keys were used to install backdoor plugins on WordPress sites.

Does installing UpdraftPlus 1.26.13 remove a backdoor?

No. The update is intended to correct key revocation, but it does not remove an already installed backdoor or an account it created. Affected sites need separate inspection and cleanup.

Why might some keys need to be deleted manually?

Nethemba says version 1.26.13 deletes keys created before 12:07 UTC on October 18, but leaves keys created between that time and 21:00 UTC that day. The firm says those keys need manual removal; site owners should follow the current TeamUpdraft advisory for the applicable procedure.

Were payment details or customer backups exposed?

TeamUpdraft said it did not store card data because Stripe and PayPal handle payments. It also said backups stored in customers’ own services, including Google Drive, Dropbox and Amazon S3, were not affected. It recommends re-authorizing storage and rotating access keys if UpdraftCentral was used to access a site.

How many WordPress sites were affected?

TeamUpdraft has not disclosed a total. Patchstack counted 99 different plugin names used in installations during the reported period, but that figure is not a count of affected sites. The number of compromised sites remains unclear.

Source: ThorstenMeyerAI.com