🔍 Read the full analysis: Stolen UpdraftCentral Keys Are Backdooring WordPress Sites. The Fix Has A Gap. on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
TeamUpdraft says attackers accessed its website and likely its customer database, then used stolen UpdraftCentral Cloud keys to install backdoors on WordPress sites. UpdraftPlus updates 1.26.13 and 2.26.13 address some exposed keys, but researchers say keys created during part of the breach window remain and updates do not remove installed backdoors.
TeamUpdraft disclosed a security breach on October 19 after attackers accessed its website and, the company believes, its customer database, which held keys used to control connected WordPress sites through UpdraftCentral Cloud. Security researchers say attackers used those keys to install backdoor plugins on affected sites, including sites running current software; the company’s latest UpdraftPlus update revokes some keys, but does not remove backdoors already installed.
TeamUpdraft, which makes the UpdraftPlus backup plugin, said attackers accessed teamupdraft.com over the weekend of October 17 and 18. Its incident notice says the customer database may have been reached and contained names, email addresses, billing addresses, order history, password hashes, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment-card data; Stripe and PayPal handled payments. It also said backups stored by customers in services such as Google Drive, Dropbox and Amazon S3 were not affected.
UpdraftPlus 1.26.13 and Premium 2.26.13 were released to apply key revocation after an earlier release, version 1.26.12, failed to delete keys, according to an analysis by security firm Nethemba. Nethemba says the newer version removes keys created before 12:07 UTC on October 18. It reports that keys created from 12:07 to 21:00 UTC that day are not removed automatically and must be deleted manually. TeamUpdraft’s stated cutoff is 22:00 British Summer Time, equivalent to 21:00 UTC.
Researchers at Patchstack said attackers issued a command to upload a plugin, which WordPress then installed and activated. They counted 99 different plugin names installed between the afternoon of October 18 and 09:23 on October 19. TeamUpdraft says the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected. The confirmed compromise described by researchers involves the cloud dashboard’s connection keys, not a newly identified flaw in the plugin’s command-signing checks.
Infographic 01 · UpdraftCentral key compromise
Stolen keys, signed commands, backdoored sites.
Keys leaked from TeamUpdraft's customer database let attackers send valid commands to connected WordPress sites. No plugin vulnerability was needed.
Timeline
Times as reported by the named source.
- 17 Oct, evening · Attacker has access to teamupdraft.com (Nethemba)
- 18 Oct, afternoon · First backdoor plugin installed via a signed UpdraftCentral command (Patchstack)
- 19 Oct, 09:23 · Latest backdoor install seen; 99 plugin names in total (Patchstack)
- 19 Oct, 13:00 UTC · TeamUpdraft publishes its incident advisory (Patchstack)
- 19 Oct · UpdraftPlus 1.26.12: key revocation ships, but a bug deletes no key (Nethemba)
- 19 Oct, evening · 1.26.13 fixes it; keys made 18 Oct 12:07–21:00 UTC still remain (Nethemba)
Patchstack and Nethemba analyses are being updated as new variants appear.
What the update does, and doesn’t
Based on Nethemba’s code review and TeamUpdraft’s advisory.
- 1
1.26.12 / 2.26.12
Meant to revoke the stolen keys. Because of a bug, it deleted none (Nethemba).
- 2
1.26.13 / 2.26.13
Revokes UpdraftCentral Cloud keys created before 12:07 UTC on 18 Oct.
- 3
Gap: 18 Oct, 12:07–21:00 UTC
Keys created in this window are not revoked, although the vendor's cutoff is 21:00 UTC.
- 4
Backdoors stay
Revoking a key does not remove an installed backdoor plugin or the account it created.
- 5
Guidance still changing
New backdoor variants keep turning up; vendor and researcher advisories are being updated.
Sources: TeamUpdraft (19 Oct 2026); Patchstack; Nethemba (updated 20 Oct 2026).
Powered by Thorsten Meyer AI
Why Stolen Keys Bypass Site Defenses
The incident shows how a legitimate remote-management credential can give an attacker substantial access without exploiting a software vulnerability. A connected site accepts commands signed with its UpdraftCentral key, including commands to install plugins. Patchstack said the attacker’s commands were correctly signed with genuine dashboard keys, so the plugin’s normal checks passed. Sites running the latest version could therefore still be affected if their keys had been exposed.
The potential impact extends beyond installing a suspicious plugin. Patchstack and Nethemba describe backdoors that can create an account, grant it additional capabilities, and authenticate the attacker with a persistent cookie that bypasses the normal login form. That can undermine protections such as two-factor authentication and login limits. Removing the plugin alone may not remove the account or other changes it made, while some variants may hide from the WordPress plugin list.
Updating is necessary, but not a complete recovery step. A site owner must also determine whether a connection key remains active and whether a backdoor or unauthorized account is already present. TeamUpdraft recommends re-authorizing external storage and rotating its access keys if UpdraftCentral was used to access the site. That advice reflects the risk that access associated with a connected site may warrant review, even though the company says customer backups in personal cloud storage were not affected.
Products Worth Considering
LG UltraGear 32-Inch QHD 180Hz Curved Gaming Monitor
LG UltraGear 27GX704A-B 27-Inch QHD OLED Gaming Monitor, 240Hz
Apple Watch SE 3 GPS 44mm Smartwatch
As an affiliate, we earn on qualifying purchases.
How the Cloud Keys Reached Sites
UpdraftPlus includes an UpdraftCentral client that is inactive until a site receives a connection key. Once connected, the site can accept commands signed with that key. TeamUpdraft’s settings can add a site to UpdraftCentral when a customer connects an account; the option is ticked by default, according to the source account of the incident. Nethemba reports the same default behavior in the Premium version. A site owner may therefore have created a connection without recognizing the resulting remote-control exposure.
Nethemba said it found the attack on three of its own sites and traced the commands to the attacker’s server. It reported that keys created as far back as November 2025 were used after the breach, because the keys did not expire. The firm said its analysis did not point to a modified plugin, weak cryptography or the older key-forgery issue CVE-2026-10795, which was fixed in UpdraftPlus 1.26.5 in June.
TeamUpdraft said it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also said it reported the incident to the UK Information Commissioner’s Office. The company’s October 19 notice and researchers’ technical findings form the basis for the currently reported response and attack details.
“The commands are correctly encrypted and signed with genuine dashboard private keys.”
— Patchstack
Affected Sites and Key Cutoffs
The number of affected customers and WordPress sites has not been disclosed. TeamUpdraft said it believes attackers reached the customer database, but the available notice does not establish how many records or keys were accessed. Researchers have documented backdoor installations, but the reported count of 99 refers to distinct plugin names, not the number of infected sites.
The precise population of exposed keys also remains uncertain. Nethemba says the latest update removes keys created before 12:07 UTC on October 18 but leaves a period of keys from 12:07 to 21:00 UTC for manual deletion. The company’s own stated cutoff extends to 22:00 BST. Site owners may need to check when their connections were created rather than assume that updating alone revokes every potentially exposed key.
Researchers warn that backdoor versions differ, and cleanup advice may change as additional variants are identified. The source reports that one early variant can trigger HTTP 500 errors before reaching its token check; Nethemba and Patchstack advise removing such a plugin rather than repairing it, because repairing it could make the backdoor active. The full scope of persistence and whether every affected site has been identified are not yet clear.
Verify Keys and Inspect Sites
Site owners should install the applicable UpdraftPlus update and consult TeamUpdraft’s current security advisory alongside the Patchstack and Nethemba analyses. They should check whether UpdraftCentral was connected and review key creation dates, with manual revocation for keys in the gap identified by Nethemba. If a backdoor or suspicious account is found, updating the plugin should not be treated as cleanup: the site needs a broader compromise response, including removal of unauthorized access and review of accounts and credentials.
TeamUpdraft’s public incident response and researcher guidance may be updated as the investigation develops. The company has not published an affected-customer count in the supplied notice. Further clarity on the number of exposed keys and sites, the limits of the revocation, and any additional cleanup steps will depend on updates from TeamUpdraft and the security firms investigating the campaign.
Key Questions
No. The releases address key revocation, but they do not remove backdoor plugins or accounts already created on a site. Affected sites need separate inspection and cleanup.
Which UpdraftPlus versions are listed as the security updates?
TeamUpdraft released UpdraftPlus 1.26.13 and UpdraftPlus Premium 2.26.13. Nethemba says version 1.26.12 did not delete keys as intended, making the later release the relevant update described in the incident reports.
Does the update revoke every potentially exposed key?
Not according to Nethemba’s analysis. It says the update removes keys created before 12:07 UTC on October 18, while keys created from then until 21:00 UTC that day require manual deletion. TeamUpdraft’s stated cutoff is 22:00 BST, or 21:00 UTC.
Were customer backups or payment-card details stolen?
TeamUpdraft said it did not store payment-card data; Stripe and PayPal processed payments. It also said backups stored in customers’ own services, including Google Drive, Dropbox and Amazon S3, were not affected. The company recommends re-authorizing storage and rotating access keys if UpdraftCentral was used to access a site.
How can site owners check for the reported backdoor?
Researchers describe suspicious plugin names and behavior, including plugins with the description “Small maintenance toolkit: keeps option storage tidy.” Names alone may not be reliable because variants differ or may hide from the plugin list. Site owners should follow the current TeamUpdraft and researcher guidance and treat a confirmed backdoor as a site compromise requiring more than a plugin update.
Source: ThorstenMeyerAI.com
