UpdraftCentral Keys Are Being Used To Backdoor WordPress Sites; The Fix Has A Gap

🔍 Read the full analysis: UpdraftCentral Keys Are Being Used To Backdoor WordPress Sites; The Fix Has A Gap on ThorstenMeyerAI.com

Age 18–24?Offer from Amazon

Prime made for students and young adults

• Fast, free delivery for dorm and study essentials
• Prime Video and Amazon Music included
• Member-only deals

Try Prime for Young Adults →Free trial for eligible 18–24 year olds

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft, the company behind the UpdraftPlus WordPress backup plugin, said attackers accessed its teamupdraft.com website over the weekend of October 17-18 and likely reached a customer database containing UpdraftCentral connection keys. Security researchers report that the keys were used to install backdoor plugins on WordPress sites, including sites running current software. TeamUpdraft released updated UpdraftPlus versions to revoke some exposed keys, but the update does not remove malware already installed.

TeamUpdraft disclosed the incident on October 19. Its incident post said the database contained customer names, email and billing addresses, order history, password hashes, two-factor authentication settings, and keys associated with UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment-card data; Stripe and PayPal process payments. Backups stored directly with services such as Google Drive, Dropbox or Amazon S3 were not affected, according to TeamUpdraft.

UpdraftCentral Cloud lets customers manage WordPress sites from a hosted dashboard. A connected site accepts commands signed with its connection key. Patchstack’s analysis says attackers used a command to upload a plugin, which WordPress then installed and activated. The researchers reported 99 different plugin names during the observed attack period, including “Site Health Cache” and “Seo Helper.” A recurring plugin description was “Small maintenance toolkit: keeps option storage tidy.” These counts describe Patchstack’s findings, not the total number of affected sites.

TeamUpdraft released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) after an earlier revocation attempt in version 1.26.12 did not remove keys, according to Nethemba’s review of the code. Nethemba says the later update removes keys created before 12:07 UTC on October 18. It reports that keys created from 12:07 to 21:00 UTC that day are not removed automatically and require manual deletion. TeamUpdraft’s stated cutoff was 22:00 British Summer Time, or 21:00 UTC.

Why a Dashboard Key Became a Site Risk

The incident matters because the exposed credentials could authorize actions through a legitimate management feature, rather than exploiting a flaw in an outdated plugin. Patchstack says the commands were signed with genuine dashboard keys, so the plugin’s normal checks accepted them. Sites running the latest UpdraftPlus version could still be affected if their connection keys were among those exposed.

The researchers say some malicious plugins created administrator-like accounts with additional privileges, then enabled access through a persistent cookie. Removing the plugin alone may not remove the account. Some versions also hid from the plugin list; one early version caused HTTP 500 errors before its activation check. Patchstack and Nethemba warn against trying to repair that error: doing so could allow the backdoor to run.

For site owners, the practical distinction is that key revocation prevents some future commands but is not incident cleanup. A site with evidence of a backdoor should be treated as compromised, and owners need to check for both malicious plugins and accounts or access methods left behind.

How the UpdraftCentral Connection Works

UpdraftPlus includes an UpdraftCentral client that remains inactive until a site is connected with a key. TeamUpdraft says selecting the option to add a website to UpdraftCentral is enabled by default when linking a TeamUpdraft account in the plugin settings. Nethemba also reported that the Premium version uses the same default. A site owner may therefore have created a connection without recognizing that the site could receive remote management commands.

Nethemba said it found the attack on three of its own sites and traced the activity to keys used from the attacker’s server. It reported that keys created in November 2025 were used after the breach, and said it found no evidence that a modified plugin, weak cryptography or the older vulnerability CVE-2026-10795 explained this incident. That vulnerability had been fixed in June 2026 in UpdraftPlus 1.26.5, according to the source material. Researchers described the incident as a separate abuse of exposed credentials.

TeamUpdraft said it closed the access route, signed out accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also reported the incident to the UK Information Commissioner’s Office. The company said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected.

“The commands are correctly encrypted and signed with genuine dashboard private keys.”

— Patchstack

Affected Sites and Key Coverage

The number of affected customers and WordPress sites has not been disclosed. TeamUpdraft said it believes attackers reached its customer database, but the source material does not establish precisely which records or keys were accessed. It is also unclear how many sites received a malicious plugin or whether all observed variants have been identified.

The scope of automated revocation has limits. Nethemba says keys created in a particular period on October 18 remain outside the update’s automatic deletion, while connections created after the cutoff are left in place. Site owners may not know when a key was created. TeamUpdraft and researchers have continued updating cleanup guidance as new backdoor variants are identified, so the precise remediation steps may change.

What Site Owners Should Check

TeamUpdraft customers should install the current UpdraftPlus release and consult the company’s latest incident advisory alongside the Patchstack and Nethemba analyses. Owners should check whether their sites were connected to UpdraftCentral, review and manually remove keys not covered by automatic revocation, and rotate access credentials for storage connected through UpdraftCentral, as TeamUpdraft recommends.

Updating alone is not enough if a site was already targeted. Site administrators should inspect for suspicious plugins, unfamiliar accounts and other signs of persistent access. If a backdoor is found, the plugin and any accounts or access mechanisms it created need to be addressed; the researchers caution that removing or repairing a visible error does not establish that a site is clean. The company’s investigation and the researchers’ technical guidance remain developing, with the total impact still unknown.

Key Questions

Does installing UpdraftPlus 1.26.13 remove a backdoor?

No. The update revokes certain older UpdraftCentral keys, but it does not remove a malicious plugin or account already installed on a site.

Were all UpdraftPlus users affected?

That has not been established. TeamUpdraft has not disclosed how many customers or sites were affected. The reported attack involved exposed UpdraftCentral keys; the company said the plugin downloads and self-hosted UpdraftCentral were not affected.

What information did TeamUpdraft say was in the database?

TeamUpdraft listed names, email and billing addresses, order history, hashed passwords, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. It said it did not store payment-card data.

Why might a site need manual key removal?

Nethemba says UpdraftPlus 1.26.13 does not automatically delete keys created between 12:07 and 21:00 UTC on October 18. Those keys may need to be removed manually, according to the firm.

What should owners do if they find a suspicious plugin?

Follow the current guidance from TeamUpdraft and the security researchers, and investigate for related accounts or persistent access. Patchstack and Nethemba warn that repairing an HTTP 500 error caused by an early backdoor variant could activate it; a site with a confirmed backdoor should be treated as compromised.

Source: ThorstenMeyerAI.com