The WordPress Risk Behind Stolen UpdraftCentral Keys—and The Fix’s Gap

🔍 Read the full analysis: The WordPress Risk Behind Stolen UpdraftCentral Keys—and The Fix's Gap on ThorstenMeyerAI.com

Age 18–24?Offer from Amazon

Prime made for students and young adults

• Fast, free delivery for dorm and study essentials
• Prime Video and Amazon Music included
• Member-only deals

Try Prime for Young Adults →Free trial for eligible 18–24 year olds

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft said on October 19, 2026, that attackers had accessed its teamupdraft.com website and likely reached customer records containing UpdraftCentral Cloud connection keys, which can authorize commands on linked WordPress sites. Security researchers report that attackers used stolen keys to install backdoor plugins, while an update intended to revoke exposed keys leaves some keys requiring manual deletion and does not remove backdoors already installed.

According to TeamUpdraft’s incident notice, the attackers accessed the company website over the weekend of October 17–18. The customer database included names, email and billing addresses, order history, hashed account passwords, two-factor authentication settings, and keys associated with UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft said it did not store payment-card data; Stripe and PayPal process payments. It also said backups held in customers’ own storage services, such as Google Drive, Dropbox or Amazon S3, were not affected.

Researchers describe the keys as a route to legitimate remote-management commands, not a software flaw that attackers had to exploit on each site. Patchstack said it observed the command plugin.upload_plugin, which caused WordPress to install and activate an uploaded plugin. Because the commands were signed with genuine dashboard keys, Patchstack said the plugin’s authorization checks passed. Sites running the latest UpdraftPlus version could still be affected if connected with an exposed key.

TeamUpdraft released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) to revoke keys. Nethemba’s code review found that version 1.26.12, released earlier on October 19, did not delete keys as intended. Nethemba says version 1.26.13 removes keys created before 12:07 UTC on October 18, but leaves keys created from 12:07 to 21:00 UTC that must be deleted manually. The company’s stated cutoff was 22:00 British Summer Time, equivalent to 21:00 UTC.

Why Remote Keys Matter

The incident shows how a credential intended for convenient site administration can become a control channel across connected WordPress sites. UpdraftPlus includes an UpdraftCentral client that remains dormant until linked with a connection key. Once authorized, the site accepts commands signed with that key, with the permissions associated with the user who created it. That means patching the plugin alone cannot protect a site if an attacker still holds a valid key.

Researchers also say the exposure may reach users who do not recall enabling remote management. Nethemba reports that the option to add a site to UpdraftCentral is ticked by default when a TeamUpdraft account is connected in settings; it says the Premium version behaves similarly. Nethemba also found keys created in November 2025 being used after the breach, indicating that old keys could remain relevant because they do not expire.

For site owners, the practical risk extends beyond plugin files. Patchstack reported 99 different plugin names in installations it counted between the afternoon of October 18 and 09:23 on October 19. The researchers say some backdoors created accounts that remained after the malicious plugin was removed. A site with evidence of compromise therefore needs investigation and account cleanup, not just a routine plugin update.

How the Attack Reached Sites

TeamUpdraft said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected. The exposed data instead included credentials for UpdraftCentral Cloud, the hosted service used to manage multiple WordPress installations from one dashboard. A connection key lets that service send authenticated commands to a linked site.

Patchstack and Nethemba describe the attacker activity as use of stolen, valid keys. Nethemba said it found the attack on three of its own sites and attributed the keys to a leak from the UpdraftCentral Cloud environment. It said its analysis did not point to a modified plugin, weak cryptography or the earlier key-forgery vulnerability CVE-2026-10795, which it said was fixed in June in version 1.26.5. These are researchers’ findings; the full scope and entry route remain subject to the company’s investigation.

TeamUpdraft said it closed the access route, signed out accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also said it reported the incident to the UK Information Commissioner’s Office. The company recommends reauthorizing storage and rotating access keys if UpdraftCentral was used to access a site.

“The commands are correctly encrypted and signed with genuine dashboard private keys.”

— Patchstack

Scope and Cleanup Still Unclear

TeamUpdraft has not disclosed how many customers or WordPress sites were affected, or provided a final account of how attackers entered the website and reached the customer database. It is also unclear how many stolen keys were used, whether all malicious plugins have been identified, and whether further backdoor variants will emerge.

The key-revocation boundary requires care: Nethemba says version 1.26.13 removes keys made before 12:07 UTC on October 18, while keys created between then and 21:00 UTC are not removed automatically. Site owners may not know when a key was created. In addition, revocation does not remove a plugin or account already placed on a site, and connections created after the cutoff are not revoked by this process.

Patchstack and Nethemba have described backdoor behavior including secret URL triggers, unauthorized accounts and persistent login cookies. Their findings concern variants they examined; they do not establish that every compromised site has identical files or indicators. Cleanup guidance may change as analysis continues.

Steps for Site Owners Now

TeamUpdraft users should install the current applicable UpdraftPlus release and review the company’s live incident advisory. Those who used UpdraftCentral should check connection status and follow instructions to reauthorize storage and rotate relevant access credentials. Because some keys may fall into the interval Nethemba says the update does not revoke, administrators should check the vendor’s latest guidance for manual key deletion rather than assuming an update cleared every connection.

Administrators should also inspect sites for unfamiliar plugins and user accounts, with particular attention to the indicators published by Patchstack and Nethemba. If a suspicious plugin is present, the researchers advise removing it rather than attempting to repair an error caused by a backdoor variant; they warn that repairing one such plugin can activate its malicious behavior. A discovered backdoor should be treated as evidence of a broader compromise, including possible unauthorized accounts and persistent access.

TeamUpdraft’s investigation and researchers’ technical analysis remain in progress. The next useful updates will be a clearer estimate of affected customers and sites, any revised cleanup indicators, and confirmation of how the remaining exposed keys should be handled.

Key Questions

What information did TeamUpdraft say was exposed?

TeamUpdraft said the customer database contained names, email and billing addresses, order history, hashed passwords, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. It said payment-card details were not stored in that database and that customer backups in their own storage were not affected.

Does updating UpdraftPlus remove a backdoor?

No. The releases 1.26.13 and 2.26.13 address key revocation, but an update does not remove a malicious plugin or account already installed on a site. Researchers advise inspecting affected sites and following current cleanup guidance.

Can a fully patched WordPress site still be affected?

Yes, according to Patchstack and Nethemba. They say attackers used valid stolen connection keys to send authorized remote commands, so the issue did not depend on an outdated UpdraftPlus version.

What is the gap in the key-revocation fix?

Nethemba says version 1.26.13 removes keys created before 12:07 UTC on October 18, but does not automatically delete keys created between that time and 21:00 UTC. The firm says those keys require manual deletion; users should check current TeamUpdraft instructions for the applicable steps.

How many sites were affected?

TeamUpdraft has not disclosed a total. Patchstack reported counting 99 plugin names in installations during the period it examined, but that figure is not a count of affected sites or customers.

Source: ThorstenMeyerAI.com