The UpdraftCentral Key Fix Has A Gap As WordPress Sites Face Backdoors

🔍 Read the full analysis: The UpdraftCentral Key Fix Has A Gap As WordPress Sites Face Backdoors on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on office and shipping supplies

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft said attackers accessed its teamupdraft.com website over the October 17–18 weekend and may have reached a customer database containing UpdraftCentral connection keys; researchers report those keys were used to install backdoor plugins on WordPress sites. The company released UpdraftPlus 1.26.13 to revoke affected keys, but the update does not remove backdoors already installed, and researchers say some keys may remain active.

According to TeamUpdraft’s October 19 incident notice, the database included customer names, email addresses, billing addresses, order history, hashed account passwords, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment-card details; payments are handled by Stripe and PayPal. Backups stored by customers with services such as Google Drive, Dropbox or Amazon S3 were not affected, TeamUpdraft said.

TeamUpdraft said it closed the access route, signed out accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also reported the incident to the UK Information Commissioner’s Office. The company said the UpdraftPlus plugin, its downloads and self-hosted UpdraftCentral were not affected. The reported exposure concerns keys associated with its hosted dashboard, UpdraftCentral Cloud.

Security firms Patchstack and Nethemba analyzed the attacks. Patchstack said it observed commands signed with genuine dashboard keys that instructed WordPress to upload and activate plugins. It counted 99 plugin names installed between the afternoon of October 18 and 09:23 UTC on October 19. Nethemba said it found the attack on three of its own sites and concluded the keys were used from an attacker-controlled server. These are researchers’ findings; TeamUpdraft has not disclosed how many customers or sites were affected.

Why Stolen Dashboard Keys Matter

UpdraftCentral keys authorize a connected site to accept commands from the remote dashboard. Researchers say the attackers used that authority to upload plugins, rather than exploiting a flaw in the WordPress sites themselves. That distinction matters: installing the latest plugin version alone may not prevent misuse of an exposed key, and a site can be fully patched yet still accept a valid command signed with a stolen credential.

The reported backdoor behavior also means removing the malicious plugin may not restore control. Patchstack and Nethemba describe variants that create an administrator-like account with additional capabilities and use a persistent login cookie. The account can remain after the plugin is removed, and some variants hide from the plugin list. Site owners who find evidence of infection should treat the site as compromised and investigate accounts and access, not assume the key update has cleaned it.

There is also a wider account-security concern because the reported database included contact and billing details, hashed passwords and two-factor settings. TeamUpdraft has not said how many records were exposed. Customers should follow the company’s incident guidance and use distinct passwords; the source material does not establish that attackers accessed or cracked account passwords.

How UpdraftCentral Keys Work

UpdraftPlus includes a client that can connect a WordPress site to UpdraftCentral, a hosted dashboard for managing multiple sites. According to the supplied incident reporting, the connection option is selected by default when a TeamUpdraft account is linked in plugin settings. A key authorizes commands on the connected site under the permissions of the user who created it. Nethemba reported that keys do not expire, and said it observed keys created in November 2025 being used after the breach.

The incident report distinguishes this exposure from an earlier vulnerability, CVE-2026-10795, which was fixed in UpdraftPlus 1.26.5 in June. Nethemba said its analysis ruled out that older forgery issue, modified plugin files and weak cryptography as explanations for the activity it examined. The researchers attributed the attack to genuine keys exposed through the UpdraftCentral Cloud environment.

TeamUpdraft released version 1.26.12 on October 19, intending to revoke pre-incident keys. Nethemba reported that a bug prevented that release from deleting any keys. Version 1.26.13 followed the same evening; its changelog said it properly applied the revocation. Nethemba’s code review found that it deletes keys created before 12:07 UTC on October 18, but not keys created from 12:07 to 21:00 UTC that day. The source says those keys must be deleted manually.

“The commands are correctly encrypted and signed with genuine dashboard private keys.”

— Patchstack

Exposure Scope and Cleanup Gaps

TeamUpdraft has not published the number of affected customers or WordPress sites, nor detailed how attackers reached the website or customer database. The company’s statement says it believes attackers accessed the database; the precise information viewed or taken has not been independently established in the supplied material.

The key cutoff also leaves a practical uncertainty for site owners: they may not know when a connection key was created. According to Nethemba, the corrected release does not delete keys created during part of October 18 that falls after its reported cutoff but before the company’s stated 22:00 BST cutoff. Those keys require manual deletion. Revoking a key does not remove a plugin or account already placed on a site, while connections created after the cutoff are not revoked by design.

Researchers reported multiple backdoor variants, including one that can trigger HTTP 500 errors before its token check. They warn against trying to repair such a plugin, because restoring its operation may activate the backdoor. The source material says cleanup advice is changing as further variants are identified; the complete set of affected indicators and a final count of compromised sites remain unknown.

Check Keys, Plugins and Accounts

Site owners using UpdraftPlus should install the current release identified by TeamUpdraft and consult the latest versions of the company’s advisory and the Patchstack and Nethemba analyses. Updating addresses the key-revocation issue covered by the release, but owners should separately review connected-site keys, especially those created during the October 18 interval researchers say is not automatically covered.

Owners should also check for unfamiliar plugins and user accounts, including accounts with names resembling data-ops or media-staff and an example.org email address, while recognizing that these are reported indicators rather than a complete list. If a suspicious plugin or account is found, the site should be treated as compromised; removing the plugin alone may leave an attacker account or other access in place. TeamUpdraft’s customer count, further incident findings and any updated cleanup guidance have not yet been provided in the source material.

Key Questions

What happened to TeamUpdraft?

TeamUpdraft said attackers accessed its teamupdraft.com website over the October 17–18 weekend and may have reached a customer database containing UpdraftCentral Cloud connection keys. The company disclosed the incident on October 19, 2026.

Does updating UpdraftPlus remove a backdoor?

No. Version 1.26.13 addresses the key revocation described by TeamUpdraft, but the update does not remove malicious plugins or accounts that may already have been installed on a site.

Were fully patched WordPress sites affected?

Patchstack reported that attackers used genuine, correctly signed UpdraftCentral keys to send plugin-install commands. According to the researchers, the attacks did not require a vulnerability in the site’s UpdraftPlus installation, so having the latest plugin version did not by itself prevent use of a stolen key.

What customer information may have been exposed?

TeamUpdraft said the database contained names, email and billing addresses, order history, hashed passwords, two-factor settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. It said it did not store payment-card data; Stripe and PayPal handle payments.

How many customers or sites were affected?

TeamUpdraft has not disclosed a total number of affected customers or WordPress sites. Researchers reported observing malicious plugin installations, but that does not establish the full scope of the incident.

Source: ThorstenMeyerAI.com