Stolen UpdraftCentral Keys And The Missing Piece In The WordPress Fix

🔍 Read the full analysis: Stolen UpdraftCentral Keys And The Missing Piece In The WordPress Fix on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on monitors, keyboards and dev gear

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft said on October 19, 2026, that attackers accessed its teamupdraft.com website over the weekend and may have reached a customer database containing UpdraftCentral Cloud connection keys. Security researchers say attackers used stolen keys to install backdoor plugins on WordPress sites, including sites running current software versions. TeamUpdraft has released an update to revoke affected keys, but updating alone does not remove a backdoor already installed.

According to TeamUpdraft’s incident notice, the accessed database contained customer names, email and billing addresses, order history, password hashes, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment card data; Stripe and PayPal process payments. It also said backups held in customers’ own storage, such as Google Drive, Dropbox or Amazon S3, were not affected. For customers who used UpdraftCentral to access a site, TeamUpdraft recommends reauthorising that storage and rotating its access keys.

TeamUpdraft says it closed the access route, signed out accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It reported the incident to the UK Information Commissioner’s Office. The company said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected. The concern is the cloud dashboard’s credentials: a connected site accepts commands signed with its key, including commands to install plugins.

TeamUpdraft released UpdraftPlus 1.26.12 on October 19 to revoke older UpdraftCentral Cloud keys, but security firm Nethemba found that version did not delete the keys because of a code bug. TeamUpdraft then released 1.26.13 for the free plugin and 2.26.13 for Premium. Nethemba’s code review found the corrected update removes keys created before 12:07 UTC on October 18. It does not remove keys created between that time and 21:00 UTC, which Nethemba says must be deleted manually.

A Valid Key Can Bypass Plugin Patches

The incident shows how stolen credentials can turn a legitimate remote-management feature into a route for installing code. Patchstack, which analysed the activity, said attackers sent a plugin.upload_plugin command. Because the commands were signed with genuine dashboard keys, the plugin’s checks passed; the attack did not require a software vulnerability in the installed UpdraftPlus version. That is why sites with the latest plugin could still be affected.

The exposure may also reach site owners who do not recall deliberately enabling remote control. The source report says the option to add a website to UpdraftCentral is ticked by default when connecting a TeamUpdraft account in UpdraftPlus settings; Nethemba reported the same default in Premium. Nethemba also found keys created in November 2025 being used after the breach, indicating that at least some keys had remained usable for months. The company has not published the number of customers or sites affected.

For administrators, there are two separate tasks: revoke credentials that may be exposed and inspect sites for signs of a backdoor. A successful update addresses the first only for keys it covers. If a malicious plugin has already created an account, that account can remain after the plugin is removed, so a version number by itself cannot confirm a site is clean.

How the Remote-Control Keys Work

UpdraftPlus includes a client for UpdraftCentral. The client remains dormant until a connection key is supplied; after connection, it can carry out commands under the permissions of the user who created that key. This design allows site owners to manage multiple WordPress installations from a central dashboard, but it also means a stolen, valid key can authorize actions without exploiting a flaw in the site’s software.

Patchstack counted 99 plugin names installed during the observed attack period, from the afternoon of October 18 to 09:23 on October 19, according to the source report. Names included “Site Health Cache,” “Seo Helper,” “Wp Forge” and “Js Clean.” Researchers identified the description “Small maintenance toolkit: keeps option storage tidy” as a useful marker. The reported backdoor could create an account, often with an @example.org address and the display name “Site Tools,” and grant permissions beyond a standard Editor role. Some versions could hide from the plugin list.

Nethemba said it found the attack on three of its own sites and traced the activity to keys used from an attacker-controlled server. It ruled out a modified plugin, weak cryptography and the older forgery flaw CVE-2026-10795, which had been fixed in June in version 1.26.5. The source report describes this as the second serious incident involving this channel in five months, though it does not provide further details on the earlier incident.

““Properly apply the revocation in 1.26.12.””

— TeamUpdraft

Key Coverage and Site Impact Remain Unknown

TeamUpdraft has not said how many customers, connection keys or WordPress sites were affected, nor has it published a full account of how attackers entered the website or how long they had access. The company believes attackers reached the customer database; that wording does not establish that every listed record or key was taken. Nethemba’s findings describe the behavior it observed and its code review, while the full scope across TeamUpdraft customers remains unreported.

The remaining key window also requires care: according to Nethemba, version 1.26.13 removes keys created before 12:07 UTC on October 18, but keys created from 12:07 to 21:00 UTC are not removed automatically. TeamUpdraft’s stated cutoff is 22:00 British Summer Time, equivalent to 21:00 UTC. The source material does not give a complete process for every account or confirm how customers can identify the creation time of each key.

Researchers also reported multiple backdoor variants, including one that can cause HTTP 500 errors before its token check runs. Cleanup advice may change as variants are found. The available information does not establish that every compromised site has been identified or that every malicious account has been removed.

Administrators Need Two Checks

Administrators should consult the current TeamUpdraft advisory and the analyses from Patchstack and Nethemba for updated instructions, install the applicable UpdraftPlus release, and check whether any keys in the uncovered creation window require manual deletion. They should also review connected storage authorisations and rotate access keys where TeamUpdraft recommends it.

Sites where suspicious plugins or accounts are found need separate incident cleanup; installing the update does not remove them. Nethemba and Patchstack warn against trying to repair a backdoor plugin that is causing errors, because changing its behavior may allow it to run. The source material does not provide a single, final cleanup checklist for all variants, so site owners should use the researchers’ latest guidance and treat a site with evidence of a backdoor as compromised.

Further clarity depends on TeamUpdraft publishing the scale of the breach, details about key creation and revocation, and any revised cleanup guidance. Until then, the immediate distinction is clear: the update can revoke certain credentials, but it cannot by itself establish that a WordPress site is clean.

Key Questions

What was stolen in the TeamUpdraft breach?

TeamUpdraft said attackers may have accessed a customer database containing personal and account information, password hashes, two-factor authentication settings and keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment card data.

Which UpdraftPlus versions address the key-revocation bug?

TeamUpdraft released UpdraftPlus 1.26.13 for the free plugin and 2.26.13 for Premium after version 1.26.12 failed to revoke keys. Nethemba says some keys created between 12:07 and 21:00 UTC on October 18 still require manual removal.

Does updating remove a backdoor plugin?

No. The update revokes keys within the covered window; it does not remove an installed backdoor or an account it created. A site with signs of compromise needs separate investigation and cleanup.

Were fully patched WordPress sites affected?

Researchers say yes. Patchstack reported that attackers used valid, stolen UpdraftCentral keys to issue signed plugin-install commands, so the attack did not depend on an unpatched software vulnerability.

How many sites were compromised?

TeamUpdraft has not disclosed a count of affected customers or sites. Patchstack counted 99 different plugin names in the observed installation activity, but that number is not a count of affected websites.

Source: ThorstenMeyerAI.com