How To Understand The Risk From Stolen UpdraftCentral Keys On WordPress

🔍 Read the full analysis: How To Understand The Risk From Stolen UpdraftCentral Keys On WordPress on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get hardware and tech essentials delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft said on October 19, 2026, that attackers had accessed its website and likely reached a customer database containing UpdraftCentral Cloud connection keys. Security researchers say attackers used stolen keys to send commands to connected WordPress sites and install backdoor plugins, meaning updating UpdraftPlus alone may not remove an existing compromise.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said the intrusion took place over the weekend of October 17 and 18. The company believes attackers accessed a database containing customer names, email and billing addresses, order history, hashed account passwords, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft said payment-card information was not held in that database because Stripe and PayPal process payments.

TeamUpdraft says it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also reported the incident to the UK Information Commissioner’s Office. The company released UpdraftPlus versions 1.26.13 and 2.26.13 to revoke exposed UpdraftCentral keys. It said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected.

Patchstack’s analysis found that attackers used the command plugin.upload_plugin to upload and activate malicious plugins. The commands were signed with genuine dashboard keys, so the plugin’s normal checks accepted them. Patchstack counted 99 plugin names used in installations from the afternoon of October 18 through 09:23 on October 19. Names included “Site Health Cache,” “Seo Helper,” “Wp Forge” and “Js Clean.” Researchers say the compromised sites did not need to be running an outdated version for the attack to work.

Why a Valid Key Can Install a Backdoor

UpdraftCentral keys are not ordinary passwords: they authorize a connected WordPress site to accept commands from the dashboard. According to Patchstack, attackers with stolen keys could issue a legitimate-looking instruction to upload and activate a plugin. That meant the attack could bypass the usual expectation that a software vulnerability or an outdated plugin was required.

The reported backdoor behavior can leave access behind after the malicious plugin is removed. Researchers say some variants create an account, often with an address ending in @example.org and a display name such as “Site Tools,” then grant it permissions including manage_options and install_plugins. Some variants can also hide from the plugin list or use a persistent login cookie. A site owner who only installs the update may therefore leave an unauthorized account or other foothold in place.

The issue can affect owners who did not realize they had enabled remote management. The option to add a site to UpdraftCentral when connecting a TeamUpdraft account is ticked by default, according to the source material. Nethemba also reported that keys do not expire, and said keys created in November 2025 were used after the breach. This makes checking past connections and reviewing current security guidance relevant even for sites that appear fully patched.

How the Key Exposure Was Found

UpdraftPlus includes an UpdraftCentral client that remains dormant until a site receives a connection key. Once connected, it executes commands signed with that key using the permissions of the user who created it. The exposure described by TeamUpdraft concerns keys held in the company’s cloud environment, not a flaw in the plugin download itself.

Nethemba said it found the attack on three of its own sites and traced the activity to the attacker’s server. It said its analysis ruled out a modified plugin, weak cryptography and the older key-forgery issue CVE-2026-10795, which was fixed in June in UpdraftPlus 1.26.5. Researchers characterized this incident as a compromise of legitimate keys rather than exploitation of that earlier bug.

The initial UpdraftPlus 1.26.12 release on October 19 was intended to revoke keys created before the incident. Nethemba reported that a bug meant the release deleted no keys. Version 1.26.13 followed later that day with a changelog entry saying the revocation was properly applied. According to Nethemba’s review, the newer release removes keys created before 12:07 UTC on October 18, but not keys created from 12:07 to 21:00 UTC that day. The source material says those remaining keys require manual deletion.

““The commands are correctly encrypted and signed with genuine dashboard private keys.””

— Patchstack

Affected Sites and Key Cutoffs

TeamUpdraft has not stated how many customers or WordPress sites were affected, nor has it publicly described the full scope of access to the database. It is also not clear from the source material how many installations received a backdoor, or whether every malicious plugin variant has been identified.

The key-revocation window also leaves a practical question for site owners. Nethemba’s review says keys created between 12:07 and 21:00 UTC on October 18 are not removed automatically by version 1.26.13, while TeamUpdraft’s stated cutoff is 22:00 BST, equivalent to 21:00 UTC. Owners may need to establish when a key was created and remove eligible keys manually. The precise cleanup steps may change as researchers identify additional variants.

TeamUpdraft says backups sent to users’ own storage, such as Google Drive, Dropbox or Amazon S3, were not affected. However, it recommends re-authorizing that storage and rotating its access keys if UpdraftCentral was used to access the site. The source does not give details about how many customers used that setup or whether any third-party storage credentials were accessed.

What Site Owners Should Check

TeamUpdraft users should consult the latest company advisory and install the relevant UpdraftPlus update, while treating that step as key revocation rather than a complete site cleanup. Owners should review the connected sites and available key records, paying particular attention to keys created during the window Nethemba says the update does not cover. If UpdraftCentral was used, the vendor’s guidance also calls for re-authorizing connected storage and rotating its access keys.

Researchers advise checking for unfamiliar plugins and unauthorized accounts, including accounts with elevated permissions or unusual names. The description “Small maintenance toolkit: keeps option storage tidy” is cited as a recurring marker in the backdoor plugins, although plugin names vary. Nethemba and Patchstack warn that one early variant can trigger HTTP 500 errors before its token check runs; they advise removing the suspect plugin rather than repairing it, because fixing the error can activate the backdoor.

Where a backdoor or unauthorized account is found, site owners should treat the site as compromised and follow current incident-response guidance rather than assuming the plugin update has restored security. TeamUpdraft’s investigation and researcher guidance remain ongoing, and the company has not published a total count of affected customers or sites.

Key Questions

Does updating UpdraftPlus remove a backdoor?

No. The update is intended to revoke certain exposed keys. It does not remove a malicious plugin or account already installed on a site, so owners need to check and clean affected installations separately.

Were all UpdraftPlus users affected?

That is not known. TeamUpdraft has not disclosed how many customers or sites were affected. The reported attack used UpdraftCentral Cloud keys, so owners should establish whether their sites were connected to that service and follow the latest vendor guidance.

What information did the exposed database contain?

TeamUpdraft said it included customer contact and billing details, order history, hashed passwords, two-factor settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment-card data in the database.

What signs of a backdoor should site owners look for?

Researchers report unauthorized plugins and accounts with unusual names or elevated permissions. One recurring plugin description is “Small maintenance toolkit: keeps option storage tidy.” Plugin names vary, so owners should not rely on a single name as a detection rule.

Were backups in Google Drive, Dropbox or Amazon S3 affected?

TeamUpdraft said backups sent to customers’ own storage were not affected. It recommends re-authorizing that storage and rotating access keys if UpdraftCentral was used to access the site.

Source: ThorstenMeyerAI.com