When Stolen UpdraftCentral Keys Become A Backdoor Into WordPress

🔍 Read the full analysis: When Stolen UpdraftCentral Keys Become A Backdoor Into WordPress on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on office and shipping supplies

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft said on October 19, 2026, that attackers had accessed its teamupdraft.com website and likely reached a customer database containing UpdraftCentral Cloud connection keys. Security researchers say attackers used stolen keys to send commands that installed backdoor plugins on WordPress sites, including sites running up-to-date software. TeamUpdraft has issued updates to revoke some keys, but updating UpdraftPlus does not remove a backdoor already installed.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said the intrusion took place over the weekend of October 17 and 18. Its incident post says the database may have contained customer names, email and billing addresses, order history, hashed account passwords, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment-card data; Stripe and PayPal process payments.

TeamUpdraft said it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It reported the incident to the UK Information Commissioner’s Office. The company said the UpdraftPlus plugin, its downloads and self-hosted UpdraftCentral were not affected. It has not disclosed how many customers or WordPress sites may be affected.

Attackers used genuine UpdraftCentral keys to issue commands to connected sites. Patchstack, which analyzed the activity, said one command uploaded and activated a plugin. The attack did not require a software flaw in the target site: a valid key authorized the command. Researchers identified numerous plugin names used in the campaign, including “Site Health Cache,” “Seo Helper,” “Wp Forge” and “Js Clean.”

Why Stolen Keys Could Control Sites

UpdraftCentral is designed to let site owners manage multiple WordPress installations from a hosted dashboard. A connected site accepts commands authenticated with its key, with the permissions of the user who created that connection. If a key is stolen, the attacker can use that trusted control channel to install software without exploiting a separate vulnerability in WordPress or the site’s plugins.

That distinction matters for response: a site can be fully patched and still be exposed if its connection key was compromised. Researchers reported that some keys had been created months earlier and did not expire. Nethemba said it found the attack on three of its own sites and traced the commands to the attacker’s server. The incident shows why owners need to check both the remote-management connection and the site itself, rather than treating a software update as a complete cleanup.

The reported backdoor behavior also creates risks beyond the initial plugin installation. Patchstack and Nethemba describe variants that can create unauthorized accounts with elevated capabilities and log an attacker in using a persistent cookie. Removing the plugin alone may not remove the account. That can leave continued access even after the visible malicious software is gone.

How the UpdraftCentral Connection Works

UpdraftPlus includes an UpdraftCentral client that remains inactive until a site is connected with a key. The source account says a checkbox to add a website to remote UpdraftCentral management is selected by default when connecting a TeamUpdraft account; Nethemba reports similar behavior in the Premium version. Site owners may therefore have established a connection without recognizing that a long-lived management key was created.

TeamUpdraft released UpdraftPlus 1.26.12 on October 19, intending to revoke keys created before the incident. Nethemba’s code review found that this release did not delete keys because of a bug. Version 1.26.13 followed, with a changelog note saying the revocation was properly applied. According to Nethemba, that version removes keys created before 12:07 UTC on October 18, but leaves a later group that may require manual deletion.

Nethemba said the attack was not caused by a modified plugin, weak cryptography or the earlier key-forgery vulnerability CVE-2026-10795, which it said was fixed in June in version 1.26.5. The source material describes this as a second serious incident involving this channel in five months, though it does not provide further details about the earlier incident.

“The UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected.”

— TeamUpdraft

Affected Sites and Keys Still Unclear

TeamUpdraft has not said how many customers, connection keys or WordPress sites were affected. The full scope of the customer-data exposure is also not yet public. The source material does not establish whether every database record was accessed or which specific customer details attackers obtained.

The key-revocation process has limits. Nethemba says keys created between 12:07 and 21:00 UTC on October 18 were not removed by version 1.26.13, while TeamUpdraft’s stated cutoff is 22:00 BST, equivalent to 21:00 UTC. Owners may need to identify and delete keys in that interval manually. A key created after the cutoff is not revoked by this process.

Researchers have found multiple backdoor variants, and cleanup guidance may change as analysis continues. Some variants can hide from the plugin list; one early version reportedly caused HTTP 500 errors before its activation check. Nethemba and Patchstack warn against repairing that error as a way to restore the site, since doing so could allow the backdoor to run. The precise number of infected sites and the full set of indicators remain unconfirmed.

Steps for Connected Site Owners

Site owners using UpdraftPlus should install the current release identified in TeamUpdraft’s advisory, then review whether their site was connected to UpdraftCentral Cloud and when its key was created. Where the connection falls within the unrecalled interval, owners should follow current vendor instructions for manual key removal. TeamUpdraft’s advisory and the continuing analyses by Patchstack and Nethemba are the cited sources for updated technical guidance.

Owners should also inspect the installed-plugin list and user accounts for unfamiliar entries, including plugins bearing the description “Small maintenance toolkit: keeps option storage tidy,” and accounts with unexpected “Site Tools” display names or elevated capabilities. A suspected backdoor should be removed rather than merely disabled or repaired; any unauthorized account and persistent access should also be addressed. TeamUpdraft recommends re-authorizing external storage and rotating access keys if UpdraftCentral was used to access a site.

Because a backdoor can leave access behind after the plugin is removed, a site where malicious code is found should be treated as compromised. The company has reported the incident to the UK regulator, but has not announced a final count or a completion date for its investigation. Further guidance and details may follow as the vendor and researchers examine additional variants.

Key Questions

Does updating UpdraftPlus remove an installed backdoor?

No. The releases are intended to revoke certain connection keys. TeamUpdraft’s advisory and researcher findings indicate that an already installed backdoor and any account it created must be checked and removed separately.

Which UpdraftPlus versions did TeamUpdraft release?

TeamUpdraft released 1.26.13 for the free version and 2.26.13 for Premium, according to the source material. Site owners should check the vendor’s current advisory for the latest instructions and version details.

Were payment-card details exposed?

TeamUpdraft said it did not store card data and that Stripe and PayPal handle payments. It reported that the database may have contained names, contact and billing addresses, order history, hashed passwords, two-factor settings and service connection keys.

How can a site owner check for a backdoor?

Review plugins and user accounts for unfamiliar entries, including plugins with the description “Small maintenance toolkit: keeps option storage tidy” and accounts with unexpected elevated permissions. Researchers say some variants may hide from the plugin list, so follow current guidance from TeamUpdraft, Patchstack and Nethemba rather than relying on a single indicator.

Are all UpdraftCentral keys revoked by version 1.26.13?

No. Nethemba says version 1.26.13 removes keys created before 12:07 UTC on October 18, while keys created later in the reported interval may need manual removal. TeamUpdraft’s stated cutoff and the researchers’ account of the revocation window should be checked against the current vendor advisory.

Source: ThorstenMeyerAI.com