Could Stolen UpdraftCentral Keys Still Put WordPress Sites At Risk?

🔍 Read the full analysis: Could Stolen UpdraftCentral Keys Still Put WordPress Sites At Risk? on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get audio and creator gear delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft confirmed on October 19 that attackers accessed its website and likely reached a customer database containing UpdraftCentral Cloud connection keys, which can authorize commands on linked WordPress sites. Security researchers report that attackers used stolen keys to install backdoor plugins, meaning updating UpdraftPlus alone may not secure a site if a backdoor or attacker account is already present.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said attackers accessed teamupdraft.com over the weekend of October 17–18. The company believes they reached a database holding customer names, email and billing addresses, order histories, hashed account passwords, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft said it did not store payment-card data; Stripe and PayPal handle payments. It also said backups sent directly to customers’ own storage, such as Google Drive, Dropbox or Amazon S3, were not affected.

TeamUpdraft says it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys, rotated keys with payment providers and reported the incident to the UK Information Commissioner’s Office. It released UpdraftPlus 1.26.13 and Premium 2.26.13 to revoke exposed keys. The company said the plugin itself, its downloads and self-hosted UpdraftCentral were not affected. However, the previous release, 1.26.12, failed to delete keys as intended, according to security firm Nethemba’s code review.

Nethemba says version 1.26.13 deletes keys created before 12:07 UTC on October 18, but keys created between then and 21:00 UTC remain and need manual deletion. That window matters because TeamUpdraft’s stated cutoff is 22:00 British Summer Time, equivalent to 21:00 UTC. Separately, Patchstack reported that attackers installed 99 different plugin names between the afternoon of October 18 and 09:23 UTC on October 19. One common description was “Small maintenance toolkit: keeps option storage tidy.”

Why a Dashboard Key Can Control a Site

UpdraftCentral keys are not merely login credentials for a dashboard. The UpdraftPlus client on a connected site can accept commands signed with the matching key, including commands to upload and install plugins. Patchstack said the observed attacker command, plugin.upload_plugin, caused WordPress to install and activate an uploaded plugin. Because the commands were signed with genuine dashboard keys, the normal signature checks passed; researchers said the attack did not require an UpdraftPlus software vulnerability. Fully patched sites could still be affected if they had a compromised connection key.

The backdoor behavior described by Patchstack and Nethemba can give an attacker continued access. Reports say a plugin waits for a secret URL parameter containing a 32-character token, then creates an account, often with an address at example.org and the display name “Site Tools.” The account can receive the Editor role along with extra capabilities to manage settings and install plugins. Some variants reportedly use a persistent login cookie that bypasses the usual login form, so ordinary two-factor authentication and login limits may not apply to that access. Removing the plugin may not remove the account, and some variants hide from the plugin list.

The exposure may be easy to miss. The option to add a site to UpdraftCentral when connecting a TeamUpdraft account is ticked by default, according to the source material. Nethemba also reported that keys can persist indefinitely; it observed keys created in November 2025 being used after the breach. For site owners, that makes checking whether remote management was enabled and whether a site has signs of compromise as important as installing the software update.

How the Key Exposure Was Identified

Nethemba said it found the attack on three of its own sites and concluded that keys leaked from the UpdraftCentral Cloud environment were used from the attacker’s server. It ruled out a modified plugin, weak cryptography and the older key-forgery issue CVE-2026-10795, which was fixed in UpdraftPlus 1.26.5 in June, according to its analysis. These are researchers’ findings, while TeamUpdraft’s investigation into the breach remains separate.

UpdraftPlus includes an UpdraftCentral client that remains dormant until a site receives a connection key. Once connected, it can carry out commands authorized by that key with the permissions of the user who created it. TeamUpdraft’s advisory and the researchers’ reports describe separate pieces of the response: the vendor’s account and key actions, and technical analysis of the commands and plugins found on affected sites. The number of affected customers and WordPress sites has not been disclosed.

“The commands are correctly encrypted and signed with genuine dashboard private keys.”

— Patchstack

The Remaining Key and Site Risks

The total scope is unknown. TeamUpdraft has not said how many customers, keys or WordPress sites were affected, or provided a complete public account of how the attackers first gained access to its website. It also remains unclear how many sites received a backdoor and how many have since been cleaned.

Key revocation has limits. Nethemba says keys created during the October 18 window from 12:07 to 21:00 UTC are not deleted by version 1.26.13 and must be removed manually. Connections created after the cutoff are not revoked, so site owners need to determine when their keys were issued. Installing the update does not remove backdoor files or accounts; the source material also says cleanup guidance is changing as researchers identify variants. A variant that produces HTTP 500 errors may become active if an administrator tries to repair it, according to Nethemba and Patchstack, which advise removing it rather than fixing it.

What Site Owners Should Check Now

Site owners using UpdraftPlus should install the current release and review TeamUpdraft’s latest advisory alongside the Patchstack and Nethemba analyses. Those who used UpdraftCentral Cloud should check whether a connection was enabled, re-authorize connected storage and rotate its access keys as TeamUpdraft recommends. They should also verify whether their key falls within the period requiring manual deletion rather than assuming the update revoked every key.

If a suspicious plugin, unexpected administrator-level account or other sign of compromise is found, the update should not be treated as a complete fix. The reported backdoor may leave an account behind after plugin removal, and a hidden plugin may not appear in the normal list. TeamUpdraft’s investigation and security researchers’ cleanup guidance remain ongoing; no final affected-site count or complete remediation account has been published.

Key Questions

Does updating UpdraftPlus remove an installed backdoor?

No. The update is intended to revoke certain connection keys. According to the source material, it does not remove an installed backdoor plugin or an account that the plugin created.

Which versions should site owners install?

TeamUpdraft released UpdraftPlus 1.26.13 and Premium version 2.26.13. The earlier 1.26.12 release was intended to revoke keys, but Nethemba reported that it did not delete them.

Were backups in Google Drive or Amazon S3 exposed?

TeamUpdraft said backups stored in customers’ own storage, including Google Drive, Dropbox and Amazon S3, were not affected. It recommends re-authorizing that storage and rotating access keys if UpdraftCentral was used to access the site.

How can a site owner tell whether a connection key was revoked?

Nethemba says version 1.26.13 deletes keys created before 12:07 UTC on October 18, but keys created between then and 21:00 UTC require manual deletion. Owners should check the vendor’s current instructions and their key’s creation time; the full set of affected keys has not been disclosed.

How many WordPress sites were affected?

TeamUpdraft has not disclosed a total. Patchstack reported 99 different plugin names installed during the observed period, but that figure is a count of names, not a confirmed count of affected sites.

Source: ThorstenMeyerAI.com