Stolen UpdraftCentral Keys Are Backdooring WordPress Sites. The Fix Has A Gap.

🔍 Read the full analysis: Stolen UpdraftCentral Keys Are Backdooring WordPress Sites. The Fix Has A Gap. on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get privacy and security gear delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft, maker of the UpdraftPlus WordPress backup plugin, said on October 19, 2026, that attackers accessed its website and likely reached a customer database containing UpdraftCentral Cloud connection keys. Security researchers report that attackers used stolen keys to install backdoor plugins on connected WordPress sites, including sites running current software; updating UpdraftPlus can revoke some keys but does not remove an installed backdoor.

TeamUpdraft said the intrusion occurred over the weekend of October 17–18 through the teamupdraft.com website. The company believes attackers accessed its customer database, which contained names, email addresses, billing addresses, order histories, password hashes, two-factor authentication settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft said it did not store payment card data; payments are processed by Stripe and PayPal. It has not disclosed how many accounts or sites may be affected.

The central risk is that an UpdraftCentral key authorizes a connected WordPress site to accept signed dashboard commands. Patchstack’s analysis says the attackers used a command to upload and activate a plugin. Because the commands were signed with genuine dashboard keys, Patchstack said the plugin’s checks accepted them; the attack did not require a vulnerability in an outdated version. TeamUpdraft said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected.

TeamUpdraft released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) to revoke exposed keys. Nethemba’s review says an earlier release, 1.26.12, did not delete keys because of a bug. The later fix removes keys created before 12:07 UTC on October 18, according to Nethemba, but leaves some keys created between 12:07 and 21:00 UTC that may need to be deleted manually. The company’s stated cutoff was 22:00 British Summer Time, equivalent to 21:00 UTC.

Why Stolen Keys Could Install Plugins

The incident shows how legitimate remote-management credentials can be used to alter a site without exploiting a software flaw. UpdraftPlus includes a dormant UpdraftCentral client, and a site linked to the hosted dashboard can act on commands signed with its connection key. Patchstack says the malicious command uploaded and activated a plugin, giving attackers a path to install code even on a patched WordPress site.

Researchers say UpdraftCentral linking may be enabled by default when a TeamUpdraft account is connected in UpdraftPlus settings. Nethemba also reports that some keys created months earlier remained usable, meaning old connections could still matter. For site owners, the response is not simply to install an update: they may need to revoke keys, check for unauthorized plugins and accounts, and treat a site with evidence of a backdoor as compromised.

The potential exposure also reaches beyond the WordPress installation itself. TeamUpdraft says the database included personal and account information, though it reported no stored payment-card data. Its recommendation to re-authorize backup storage and rotate access keys for sites managed through UpdraftCentral highlights the need to review linked services as well as the site.

How the Dashboard Keys Work

UpdraftCentral Cloud is a hosted dashboard for managing multiple WordPress sites. UpdraftPlus contains a client that remains inactive until a site is connected with a key. Once connected, the site accepts properly signed commands from the dashboard, including commands to install plugins. The stolen credentials were therefore access keys for remote site management, rather than a defect in the backup plugin that attackers needed to exploit.

Patchstack counted 99 different plugin names installed between the afternoon of October 18 and 09:23 on October 19. It identified names including “Site Health Cache,” “Seo Helper,” “Wp Forge” and “Js Clean.” Patchstack and Nethemba describe a common plugin description, “Small maintenance toolkit: keeps option storage tidy,” as a useful indicator, though variants may differ. Their analyses say some versions create unauthorized accounts with elevated capabilities and can hide from the plugin list.

TeamUpdraft said it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also said it reported the incident to the UK Information Commissioner’s Office. The source material identifies this as a second serious incident involving this channel in five months, but does not provide details of the earlier incident.

“The UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected.”

— TeamUpdraft, in its incident advisory

The Exposed Accounts and Cleanup

The number of affected customers and sites remains undisclosed. TeamUpdraft said it believes attackers reached the customer database, but the source material does not state how many records or keys were accessed, or identify all sites where attackers installed a backdoor. It is also not clear whether all exposed data was copied or misused.

The key-revocation boundary needs careful checking. Nethemba says keys created between 12:07 and 21:00 UTC on October 18 are not removed by version 1.26.13 and must be deleted manually, while keys made after the cutoff are left in place. The available information does not specify the exact steps for every account or whether TeamUpdraft has directly contacted all affected customers.

Updating UpdraftPlus does not remove malicious plugins or accounts already added to a site. Researchers have also reported multiple backdoor variants, including one that may cause HTTP 500 errors before its token check. The source material says cleanup guidance is changing as variants are found; the full extent of persistence and the status of every infected site are not yet known.

Check Keys and Inspect Sites

Site owners should install the appropriate UpdraftPlus 1.26.13 or Premium 2.26.13 release and consult the current TeamUpdraft advisory for steps to identify and revoke affected connections. Those using UpdraftCentral should review linked sites and, where advised, re-authorize storage services and rotate their access credentials. The reported manual-removal window means an update alone may not revoke every potentially exposed key.

Owners should also inspect sites for unfamiliar plugins, administrator or other unauthorized accounts, and suspicious access. If a suspicious plugin causes errors, Patchstack and Nethemba warn against trying to repair it: remove it and follow current incident-response guidance. A site where a backdoor is found should be treated as compromised, since removing the plugin alone may not remove accounts or other changes it created.

TeamUpdraft’s public advisory and the analyses from Patchstack and Nethemba are the named sources for ongoing technical guidance. Further updates are needed to clarify the number of affected customers and sites, the final scope of exposed keys, and whether the company or researchers identify additional backdoor variants.

Key Questions

Does installing the UpdraftPlus update remove a backdoor?

No. The 1.26.13 and 2.26.13 updates revoke some exposed keys, but the source material says they do not remove a backdoor or accounts already installed on a site. Affected sites need separate inspection and cleanup.

Which UpdraftPlus versions did TeamUpdraft release?

TeamUpdraft released version 1.26.13 for the free plugin and 2.26.13 for Premium. Nethemba reported that the preceding 1.26.12 release did not delete keys because of a bug.

Are all exposed connection keys revoked by the update?

Not according to Nethemba’s analysis. It says version 1.26.13 removes keys created before 12:07 UTC on October 18, but leaves keys created from 12:07 to 21:00 UTC that may require manual deletion. Check TeamUpdraft’s current advisory for instructions that apply to your account.

Was payment-card information exposed?

TeamUpdraft said it did not store payment-card data; Stripe and PayPal handled payments. The customer database did contain information such as names, email and billing addresses, order history, password hashes and connection keys.

What should I do if my site has an unfamiliar plugin?

Follow the current guidance from TeamUpdraft and the researchers. Patchstack and Nethemba warn that some malicious plugins may hide themselves or cause errors, and advise against repairing a suspicious broken plugin. Treat a site where a backdoor is found as compromised and investigate for accounts and other changes as well as the plugin.

Source: ThorstenMeyerAI.com