How Stolen UpdraftCentral Keys Put WordPress Backdoors On The Radar

🔍 Read the full analysis: How Stolen UpdraftCentral Keys Put WordPress Backdoors On The Radar on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on monitors, keyboards and dev gear

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Attackers used stolen UpdraftCentral Cloud connection keys to install backdoor plugins on WordPress sites after accessing TeamUpdraft’s website over the weekend of October 17–18, the company said. The incident matters because the commands were accepted as legitimate: sites running the latest UpdraftPlus version could be affected, and installing the latest update does not remove a backdoor already on a site.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, disclosed the breach on October 19. It said attackers accessed teamupdraft.com and the company believes they reached a customer database containing names, email and billing addresses, order history, hashed account passwords, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment-card data; Stripe and PayPal handled payments. It also said backups stored by customers in services such as Google Drive, Dropbox or Amazon S3 were not affected.

Security firms Patchstack and Nethemba reported that attackers used UpdraftCentral keys to send commands that uploaded and activated plugins. Patchstack counted 99 different plugin names installed between the afternoon of October 18 and 09:23 on October 19. Names included “Site Health Cache,” “Seo Helper” and “Wp Forge.” A recurring plugin description, “Small maintenance toolkit: keeps option storage tidy,” is one indicator researchers identified, though the variants differ.

TeamUpdraft released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) to revoke exposed keys after an earlier release, 1.26.12, failed to do so, according to Nethemba’s code review. The company said it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It reported the incident to the UK Information Commissioner’s Office. TeamUpdraft has not disclosed how many customers or WordPress sites were affected.

Why Valid Keys Bypassed Site Defenses

The incident shows how a trusted remote-management connection can become a route to site compromise when its credentials are exposed. According to Patchstack, the attacker’s commands were properly signed with genuine dashboard keys, so the UpdraftPlus client accepted them. The attack did not depend on exploiting an unpatched software flaw; sites with current software could still act on commands authorized by a stolen key.

Researchers said the installed backdoor could create an account, grant it additional capabilities and let an attacker log in with a persistent cookie. Some versions could hide from the plugin list. Nethemba and Patchstack warned that removing the plugin alone may not remove the account it created. That leaves site owners with a cleanup task beyond applying a software update: they need to inspect both plugins and user accounts, and treat a site where a backdoor is found as compromised.

The reach may be difficult for owners to judge. UpdraftPlus includes an UpdraftCentral client, and the option to add a site to UpdraftCentral is ticked by default when connecting a TeamUpdraft account, according to the source material. Researchers also reported that keys did not expire automatically, with Nethemba observing use of keys created in November 2025. That means owners may need to investigate connections made well before the breach.

How UpdraftCentral Keys Work

UpdraftCentral Cloud is a hosted dashboard for managing multiple WordPress sites. UpdraftPlus contains a client that can receive commands from the dashboard after a site has been connected with a key. As described by Patchstack, a site accepts commands signed with the corresponding key, including commands to install a plugin. The key therefore authorizes remote actions under the permissions associated with its creation.

Nethemba said it found the attack on three of its own sites and traced the activity to keys used from the attacker’s server. It said its analysis ruled out a modified plugin, weak cryptography and the older forgery vulnerability CVE-2026-10795, which was fixed in June in UpdraftPlus 1.26.5. The source material describes this as the second serious incident involving this channel in five months; the details of the earlier incident are not provided here.

TeamUpdraft said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected. The exposure described by the company and researchers concerns the customer database and keys associated with its hosted services, rather than a general compromise of every UpdraftPlus installation.

“The commands are correctly encrypted and signed with genuine dashboard private keys.”

— Patchstack

Key Cutoffs and Site Exposure

The total number of affected customers, keys and WordPress sites remains unknown. TeamUpdraft has not published an affected-site count. The database was believed to have been accessed, but the company’s investigation may still establish the extent of the exposure.

There is also a reported gap in key revocation. Nethemba said version 1.26.13 deletes keys created before 12:07 UTC on October 18, but does not delete keys created between 12:07 and 21:00 UTC that day. The source material says TeamUpdraft’s stated cutoff was 22:00 British Summer Time, or 21:00 UTC, and that keys in the interval need manual deletion. Owners may not know when a particular key was created, and connections made after the cutoff are not removed by the revocation.

The precise cleanup steps may change as researchers identify more backdoor variants. A plugin error is not a reliable sign that a site is safe: researchers warned that an early variant could cause HTTP 500 errors before checking its trigger, and repairing that error could allow the backdoor to run. The available material does not establish how many variants remain under investigation.

Actions for Site Owners Now

Owners using UpdraftPlus should install the applicable current release and consult TeamUpdraft’s latest advisory alongside the Patchstack and Nethemba analyses. Updating is necessary to address key revocation, but it is not a cleanup step. Owners should check for unfamiliar plugins and administrator or other unexpected accounts, remove suspicious backdoors rather than attempting to repair them, and investigate any persistent login mechanisms researchers describe.

TeamUpdraft recommends re-authorizing external storage and rotating its access keys if UpdraftCentral was used to access a site. This is separate from the company’s statement that backups stored in customers’ own storage were not affected: the recommendation addresses credentials used to connect those services. Site owners should also check whether any exposed UpdraftCentral keys remain and manually revoke keys in the reported cutoff gap where applicable.

TeamUpdraft’s investigation and researchers’ cleanup guidance are still developing. The next material updates are likely to clarify the number of affected customers and sites, the status of keys that fall outside automated revocation, and any additional indicators or remediation instructions for backdoor variants. Until those details are published, a site with signs of unauthorized plugin installation should be treated as compromised rather than considered clean after a routine update.

Key Questions

What happened in the TeamUpdraft breach?

TeamUpdraft said attackers accessed its website over the weekend of October 17–18, 2026, and the company believes they reached a customer database containing connection keys for its hosted services. Patchstack and Nethemba reported that stolen UpdraftCentral keys were used to install backdoor plugins on WordPress sites.

Does updating UpdraftPlus remove an installed backdoor?

No. TeamUpdraft’s update is intended to revoke exposed keys, but researchers warn that it does not remove a backdoor plugin or an account the backdoor created. Affected sites need a separate review and cleanup.

Were all UpdraftPlus users and backups affected?

The number of affected customers and sites has not been disclosed. TeamUpdraft said its UpdraftPlus plugin, downloads and self-hosted UpdraftCentral were not affected, and that backups stored in customers’ own services were not affected. It recommended re-authorizing storage and rotating its access keys if UpdraftCentral was used to access a site.

What should site owners check for?

Install the applicable current UpdraftPlus version, review the current guidance from TeamUpdraft and the researchers, and inspect for unfamiliar plugins and unauthorized accounts. If a backdoor is found, do not assume an update or plugin removal has fully cleaned the site; persistent accounts and login mechanisms may remain.

Source: ThorstenMeyerAI.com