What WordPress Teams Should Know About The UpdraftCentral Key Threat

🔍 Read the full analysis: What WordPress Teams Should Know About The UpdraftCentral Key Threat on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on office and shipping supplies

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft disclosed a security breach on October 19, saying attackers accessed its teamupdraft.com website over the weekend of October 17 and 18 and may have reached a customer database containing UpdraftCentral Cloud connection keys. Security researchers say attackers used stolen keys to install backdoor plugins on WordPress sites, including sites running current software versions. TeamUpdraft has released UpdraftPlus updates to revoke some keys, but updating the plugin does not remove an installed backdoor.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said the database may have included customers’ names, email and billing addresses, order history, hashed account passwords, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment-card data; payments are handled by Stripe and PayPal. It also said backups sent directly to services such as Google Drive, Dropbox or Amazon S3 were not affected.

Patchstack’s analysis of the attack found that commands signed with genuine UpdraftCentral keys were used to upload and activate plugins. It counted 99 different plugin names installed between the afternoon of October 18 and 09:23 on October 19. A recurring description was “Small maintenance toolkit: keeps option storage tidy.” Some reported variants create an unauthorized account with elevated permissions and a persistent login cookie; some hide from the plugin list. Patchstack and Nethemba warn that removing the plugin alone may not remove the account it created.

TeamUpdraft released UpdraftPlus versions 1.26.13 (free) and 2.26.13 (Premium) after an earlier revocation attempt in version 1.26.12 did not work as intended, according to Nethemba’s code review. Nethemba says version 1.26.13 deletes keys created before 12:07 UTC on October 18. It says keys created between 12:07 and 21:00 UTC that day are not deleted by the update and require manual removal. TeamUpdraft’s stated cutoff is 22:00 British Summer Time, equivalent to 21:00 UTC.

Why a Dashboard Key Can Control a Site

UpdraftCentral is designed to manage multiple WordPress installations remotely. According to Patchstack, once a site is connected, it accepts commands correctly signed with its connection key, including commands to install plugins. The attacker therefore did not need to exploit a flaw in the current UpdraftPlus code to use a stolen key. Sites running the latest version could still be affected if they had an exposed key and the attacker used it to issue a valid command.

The incident also means that a routine plugin update is only part of the response. The update addresses affected keys within its revocation scope; it does not inspect every site for an already-installed backdoor, remove unauthorized user accounts, or delete keys outside that scope. Site owners and administrators may need to review connected sites individually, investigate unexpected plugins and accounts, and follow current vendor and researcher guidance. If UpdraftCentral was used to reach a site, TeamUpdraft recommends re-authorizing connected storage and rotating its access keys.

How UpdraftCentral Keys Were Exposed

UpdraftPlus includes an UpdraftCentral client that remains inactive until a site is connected with a key. The source material says the connection option is ticked by default when a TeamUpdraft account is connected in UpdraftPlus settings. Nethemba also reported that the Premium version behaves this way. That default can leave site owners unaware that a remote-management key exists. Nethemba says keys do not expire and observed keys created in November 2025 being used after the breach.

Nethemba reported finding the attack on three of its own sites and concluded that keys were obtained from the UpdraftCentral Cloud environment and used from an attacker-controlled server. It said its analysis ruled out a modified plugin, weak cryptography and the older key-forgery issue CVE-2026-10795, fixed in June in version 1.26.5. The source material describes this as the second serious incident involving this channel in five months, though it does not provide further details about the earlier incident.

TeamUpdraft said it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also said it reported the incident to the UK Information Commissioner’s Office. These steps address parts of the breach, but they do not establish which customers or WordPress sites were affected.

““The commands are correctly encrypted and signed with genuine dashboard private keys.””

— Patchstack

Affected Sites and Key Cutoffs

The number of affected customers and sites is not known from the available information. TeamUpdraft has not said how many records were accessed or provided a site-by-site list of installations that received malicious commands. It is also unclear whether all stolen keys were used or whether additional backdoor variants remain to be identified.

There is a difference between TeamUpdraft’s stated 22:00 BST cutoff and the key deletion window Nethemba reports for version 1.26.13. Nethemba says keys created from 12:07 to 21:00 UTC on October 18 are not removed automatically. The available source material does not explain whether TeamUpdraft has since changed its guidance or how owners can reliably determine a key’s creation time. Cleanup advice may change as researchers identify further variants.

Checks Site Owners Should Make

Administrators should install the applicable UpdraftPlus update and check TeamUpdraft’s current advisory alongside the latest Patchstack and Nethemba analyses. They should review sites connected to UpdraftCentral, look for unfamiliar plugins and accounts, and treat a site where a backdoor is found as compromised. Researchers warn against attempting to repair a reported variant that causes HTTP 500 errors: changing it may allow the backdoor’s token check to run. Their guidance is to remove the malicious plugin and investigate the site rather than simply restore normal operation.

Where applicable, owners should manually revoke keys not covered by the update, review connected storage authorizations, and rotate relevant access keys. Any cleanup should account for accounts that may remain after plugin removal. The next milestones are updated vendor guidance and further findings from the investigation; TeamUpdraft has not announced a final affected-site count in the supplied material.

Key Questions

Does updating UpdraftPlus remove a backdoor?

No. The update revokes certain connection keys, but it does not remove an already-installed backdoor or accounts created by it. Affected sites need separate inspection and cleanup.

Were sites running the latest UpdraftPlus version safe?

Not necessarily. Patchstack says attackers used genuine keys to send valid remote commands, so current plugin versions could still be affected if a site had a key the attackers could use.

What information did TeamUpdraft say may have been exposed?

The company said the database may have included names, email and billing addresses, order history, hashed passwords, two-factor settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. It said it did not store card data and that backups sent to customers’ own storage were not affected.

What should administrators check on their WordPress sites?

Install the relevant update, consult current TeamUpdraft and researcher advisories, and inspect connected sites for unfamiliar plugins and user accounts. If a backdoor is found, removing the plugin alone may not be enough; investigate the account and other access it may have left behind.

Source: ThorstenMeyerAI.com