Stolen UpdraftCentral Keys: How WordPress Backdoors Happen And What The Fix Misses

🔍 Read the full analysis: Stolen UpdraftCentral Keys: How WordPress Backdoors Happen And What The Fix Misses on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get smart everyday buys delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft confirmed on October 19 that attackers accessed its teamupdraft.com website and may have reached a customer database containing UpdraftCentral Cloud connection keys. Security researchers report those keys were used to install backdoor plugins on WordPress sites, making the incident a risk even for sites running current software. TeamUpdraft released an update to revoke exposed keys, but updating alone does not remove an installed backdoor.

In its incident post, TeamUpdraft said the database held customer names, email and billing addresses, order history, password hashes, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment-card data; Stripe and PayPal process payments. Backups sent directly to customers’ own storage services, such as Google Drive, Dropbox or Amazon S3, were not affected. TeamUpdraft nevertheless recommends re-authorising that storage and rotating access keys if UpdraftCentral was used to manage the site.

TeamUpdraft said it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also reported the breach to the UK Information Commissioner’s Office. The company said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected. Its free and Premium plugin updates are versions 1.26.13 and 2.26.13, respectively.

Researchers at Patchstack analysed the attack and said attackers sent a command to upload a plugin, which WordPress then installed and activated. Patchstack counted 99 different plugin names used between the afternoon of October 18 and 09:23 on October 19. One recurring description was “Small maintenance toolkit: keeps option storage tidy.” Names included “Site Health Cache,” “Seo Helper,” “Wp Forge” and “Js Clean.”

Why the Stolen Keys Worked

The breach illustrates a distinction between a software flaw and misuse of legitimate access. UpdraftCentral keys let the hosted dashboard issue commands to connected WordPress sites. Patchstack said the malicious commands were properly encrypted and signed with genuine dashboard keys, so the plugin’s checks accepted them. The researchers said no vulnerability in the installed plugin was needed, and sites with the latest version could still be affected.

That makes a routine plugin update an incomplete response. A site may have accepted a malicious command before the key was revoked, leaving a separate plugin and account behind. Some backdoor variants reportedly hide from the plugin list. Others can create an administrator-capable account and log in using a persistent cookie, bypassing the usual login form and its protections. Site owners need to investigate the site itself, not assume the latest plugin version means it is clean.

How UpdraftCentral Connects Sites

UpdraftPlus includes a client for UpdraftCentral. The client remains dormant until a site is connected with a key; once connected, it can carry out correctly signed commands with the permissions associated with that key. TeamUpdraft’s account-connection screen has an option to add a site to UpdraftCentral that is selected by default, according to the supplied incident reporting. That means some site owners may have created a connection without recognising its security significance.

Nethemba, a security firm that said it found the attack on three of its own sites, reported that keys created as far back as November 2025 were used after the breach. It said the activity came from the attacker’s server and linked it to keys leaked from the UpdraftCentral Cloud environment. Nethemba ruled out a modified plugin, weak cryptography and the earlier forgery issue CVE-2026-10795, which it said was fixed in June in version 1.26.5. The reported incident follows another serious event involving this channel five months earlier, according to the source material.

“The commands are correctly encrypted and signed with genuine dashboard private keys.”

— Patchstack

Exposure and Cleanup Still Unclear

TeamUpdraft has not said how many customers or WordPress sites were affected, or published a full account of how attackers gained access to the website. The company’s statement that the customer database was likely reached does not establish that every record or key was taken. It is also not clear from the available information how many compromised sites have been identified or whether the attack has ended.

There is a further gap in the revocation dates reported by Nethemba. The firm said version 1.26.13 deletes keys created before 12:07 UTC on October 18, while keys created from 12:07 to 21:00 UTC that day are not removed by the update and must be deleted manually. TeamUpdraft’s stated cutoff is 22:00 British Summer Time, equivalent to 21:00 UTC. Keys created after the cutoff are not revoked. Researchers and the vendor may revise cleanup advice as they identify additional backdoor variants.

A compromised site may also have lasting changes. Researchers said removing the backdoor plugin does not remove the account it created. Some early variants return HTTP 500 errors before checking for their activation token. Nethemba and Patchstack warn against attempting to repair that error: doing so may allow the backdoor to run. The complete extent of persistence or secondary access has not been established in the supplied reporting.

What Site Owners Should Check

Site owners using UpdraftPlus should install the current version and consult the latest TeamUpdraft advisory alongside Patchstack’s and Nethemba’s analyses. They should determine whether the site was connected to UpdraftCentral and whether its key falls within the interval researchers say requires manual deletion. Because the update does not clean an infected site, owners should also look for suspicious plugins and accounts, including accounts with unusual email addresses or elevated permissions.

If a suspicious plugin produces an HTTP 500 error, researchers advise removing it rather than repairing it. Any suspected compromise calls for a broader review of the site and its credentials, not only the UpdraftPlus installation. TeamUpdraft has not announced a final affected-site count or a completed investigation, so owners should monitor updated vendor and researcher guidance as findings develop.

Key Questions

Does updating UpdraftPlus remove a backdoor?

No. The update revokes certain connection keys, but it does not remove a backdoor plugin or an account already created on a site. Site owners need to check for those changes separately.

Which UpdraftPlus versions include the reported key revocation?

TeamUpdraft released version 1.26.13 for the free plugin and 2.26.13 for Premium. Nethemba reported that the preceding 1.26.12 release did not revoke keys because of a bug.

Were backups stored in Google Drive or Dropbox exposed?

TeamUpdraft said backups stored directly with services such as Google Drive, Dropbox or Amazon S3 were not affected. It recommends re-authorising storage and rotating access keys if UpdraftCentral was used to access the site.

How can an affected site be identified?

Researchers identified suspicious plugin names and a recurring description, but some variants can hide from the plugin list. Check current guidance from TeamUpdraft, Patchstack and Nethemba, and review unexpected accounts and site activity rather than relying on one indicator.

How many customers or sites were affected?

TeamUpdraft has not disclosed a number of affected customers or sites. The scope of the incident remains under investigation.

Source: ThorstenMeyerAI.com