The Fix Has A Gap: Stolen UpdraftCentral Keys And WordPress Site Risk

🔍 Read the full analysis: The Fix Has A Gap: Stolen UpdraftCentral Keys And WordPress Site Risk on ThorstenMeyerAI.com

TeamUpdraft said on October 19, 2026, that attackers accessed its teamupdraft.com website and may have reached a customer database containing UpdraftCentral Cloud connection keys; security researchers report that stolen keys were used to install backdoor plugins on WordPress sites. The company has released UpdraftPlus updates intended to revoke exposed keys, but updating the plugin does not remove a backdoor already installed on a site.

According to TeamUpdraft’s incident notice, the attackers accessed the website over the weekend of October 17–18. The company believes they reached a database holding customer names, email and billing addresses, order histories, hashed account passwords, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft said it did not store payment card data; Stripe and PayPal handle payments. It also said backups stored in customers’ own services, such as Google Drive, Dropbox or Amazon S3, were not affected.

TeamUpdraft said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected. The exposure concerns credentials used by the hosted UpdraftCentral Cloud service to manage connected WordPress sites. Patchstack’s analysis found that attackers used genuine dashboard keys to send commands that uploaded and activated plugins. Because the commands were authorized with stolen keys, this did not require exploiting a software flaw, and fully patched sites could be affected.

The company released UpdraftPlus versions 1.26.13 (free) and 2.26.13 (Premium) to revoke keys, after an earlier release, 1.26.12, failed to remove them, according to security firm Nethemba’s review. Nethemba says the corrected version removes keys created before 12:07 UTC on October 18, but keys created from 12:07 to 21:00 UTC that day may need manual removal. The update does not remove malicious plugins or accounts already created on a site.

Why Stolen Keys Could Control Sites

UpdraftCentral lets site owners manage multiple WordPress installations from a central dashboard. A connected site accepts commands signed with its connection key, including commands to install plugins. In this incident, researchers say attackers used that legitimate capability to place backdoors, meaning the attack could bypass the usual protections against unauthorized login or software installation without exploiting an unpatched plugin vulnerability.

Patchstack reported 99 plugin names observed in installations between the afternoon of October 18 and 09:23 UTC on October 19. It identified a recurring description, “Small maintenance toolkit: keeps option storage tidy,” as a useful indicator. Researchers say some variants create administrator-like accounts, establish persistent access and may hide from the plugin list. The count is a researcher observation, not a stated total of affected sites; TeamUpdraft has not disclosed how many customers or installations may be involved.

The practical risk is that a site may remain compromised after the connection key is revoked or UpdraftPlus is updated. Site owners who used UpdraftCentral need to review plugins and accounts, and should treat a detected backdoor as a broader compromise rather than a problem solved by deleting one visible plugin.

How the Dashboard Connection Works

UpdraftPlus includes a client component for UpdraftCentral. It remains dormant until a site is connected with a key, after which it can carry out commands authorized by that key. TeamUpdraft’s settings, according to the source material, have an option to add a site to UpdraftCentral that is enabled by default when connecting an account. This may mean some site owners created a connection without recognizing its security implications.

Nethemba said keys it observed had been created as early as November 2025 and did not expire. The firm reported finding the attack on three of its own sites and concluded the keys came from the UpdraftCentral Cloud environment. It said its analysis ruled out a modified plugin, weak cryptography and the older key-forgery vulnerability CVE-2026-10795, which was fixed in June in version 1.26.5. Those conclusions are Nethemba’s findings, not a complete public account of the breach’s cause.

TeamUpdraft says it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also said it reported the incident to the UK Information Commissioner’s Office. The company’s response addresses access to its services; it does not by itself confirm that every connected WordPress site is clean.

“The UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected.”

— TeamUpdraft, in its incident notice

Affected Sites and Key Cutoffs

TeamUpdraft has not said how many customers or WordPress sites were affected, or published a full accounting of what the attackers accessed. The company says it believes the customer database was reached; the extent of data extraction has not been specified in the supplied account. It is also unclear how many malicious plugins remain active.

There is a discrepancy in the reported revocation window. TeamUpdraft’s stated cutoff is 22:00 BST on October 18, equivalent to 21:00 UTC, while Nethemba says version 1.26.13 automatically removes keys created before 12:07 UTC. According to Nethemba, keys created between 12:07 and 21:00 UTC are not removed by the update and require manual action. Site owners may not know when their connection key was created.

Researchers and the vendor have not provided a final account of all backdoor variants or a single, settled cleanup procedure. Some reported variants can cause server errors or conceal themselves, so a visible plugin list may not show every sign of compromise.

Checks Owners Should Make Now

TeamUpdraft’s response and the security analysis are still developing. Owners who used UpdraftCentral should install the current applicable UpdraftPlus release, then consult TeamUpdraft’s advisory and the latest guidance from Patchstack and Nethemba for key revocation and site inspection. If UpdraftCentral was used to access a site’s remote storage, TeamUpdraft recommends reauthorizing that storage and rotating its access keys.

Owners should also look for unfamiliar plugins and accounts, including accounts with an “@example.org” address or the display name “Site Tools,” which researchers describe among the observed indicators. A matching indicator warrants investigation; its absence does not prove a site is clean. If a backdoor or unauthorized account is found, removing the plugin alone may not remove persistent access. The supplied guidance warns against attempting to repair a broken suspicious plugin, as doing so could activate its backdoor.

TeamUpdraft has not announced a final affected-site count or a completion date for its investigation. Further vendor notices and researcher updates are the next milestones for clarifying which keys require manual revocation and how site owners should handle newly identified variants.

Key Questions

Does installing UpdraftPlus 1.26.13 remove a backdoor?

No. The update is intended to revoke some exposed connection keys. It does not remove a malicious plugin or account already installed on a WordPress site.

Were all UpdraftPlus users affected?

That is not known. TeamUpdraft has not disclosed how many customers or sites were affected. The reported risk concerns sites connected to UpdraftCentral Cloud with keys that attackers obtained and used.

What information did the customer database contain?

TeamUpdraft says it contained names, contact and billing addresses, order history, hashed passwords, two-factor authentication settings, and service connection keys. The company said payment card data was handled by Stripe and PayPal, not stored in the database.

What should I do if I find a suspicious plugin?

Follow current guidance from TeamUpdraft and security researchers. The source material warns that removing a suspicious plugin may not remove accounts or other persistence, and that repairing a broken backdoor variant can activate it. Treat a confirmed backdoor as evidence of a wider site compromise.

Source: ThorstenMeyerAI.com