Understanding The WordPress Backdoor Risk From UpdraftCentral Keys

🔍 Read the full analysis: Understanding The WordPress Backdoor Risk From UpdraftCentral Keys on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft said on October 19, 2026, that attackers had accessed its website and likely reached a customer database containing UpdraftCentral Cloud connection keys, which researchers say were used to install backdoor plugins on WordPress sites. The company has released updated versions of UpdraftPlus to revoke some exposed keys, but updating does not remove a backdoor or attacker-created account already on a site.

According to TeamUpdraft’s incident notice, the attack took place over the weekend of October 17–18, targeting teamupdraft.com. The company believes attackers accessed a database containing customer names, email and billing addresses, order history, hashed account passwords, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft said it did not store payment-card data; Stripe and PayPal process payments. It also said backups stored directly with services such as Google Drive, Dropbox or Amazon S3 were not affected.

Security firms Patchstack and Nethemba reported that attackers used genuine UpdraftCentral keys to send commands that uploaded and activated malicious plugins. Patchstack identified 99 plugin names used in installations from the afternoon of October 18 through 09:23 on October 19. A recurring description was “Small maintenance toolkit: keeps option storage tidy.” The malicious software could create a privileged account and provide access through a persistent login cookie, according to the researchers. Removing the plugin may not remove the account.

TeamUpdraft released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) after an earlier version, 1.26.12, failed to revoke keys as intended, according to Nethemba’s review. Nethemba says the corrected update revokes keys created before 12:07 UTC on October 18, but some keys created later that day may require manual removal. TeamUpdraft says it closed the access route, signed out accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys, rotated payment-provider keys and reported the incident to the UK Information Commissioner’s Office.

Why a Dashboard Key Could Install a Backdoor

The incident shows how a stolen management credential can put connected sites at risk without exploiting a flaw in the WordPress software itself. UpdraftCentral keys authorize commands from a remote dashboard; researchers say the attackers’ commands were correctly signed with genuine keys. That means fully patched sites could still be affected if they had a compromised connection key.

The risk may extend beyond site owners who knowingly used the hosted dashboard. UpdraftPlus includes an UpdraftCentral client, and the option to add a site to UpdraftCentral is ticked by default when connecting a TeamUpdraft account, according to the source material. Nethemba also reported that keys did not expire and found older keys used after the breach. The incident therefore raises practical questions for administrators about whether a connection was created, when its key was issued, and whether it remains active.

For site operators, the distinction between credential revocation and incident cleanup matters. Revoking a key can prevent further commands using that key, but it does not undo an installation that has already happened. Administrators need to check for unauthorized plugins and accounts as well as apply the software update and follow current vendor and researcher guidance.

How the UpdraftCentral Connection Works

UpdraftPlus is a WordPress backup plugin, while UpdraftCentral Cloud is a hosted dashboard for managing multiple WordPress sites. The UpdraftPlus client can remain inactive until a site is connected using a key. Once connected, the site accepts commands signed with that key, acting with the permissions associated with the user who created it.

Patchstack said the attackers used a command called plugin.upload_plugin to upload and activate a plugin. It reported that the process passed the plugin’s signature checks because the commands were signed with legitimate dashboard keys. The researchers said the attack did not require a software vulnerability and that they found no evidence in their analysis of a modified UpdraftPlus plugin or weak cryptography. Nethemba said it ruled out the older forgery bug CVE-2026-10795, which was fixed in June in version 1.26.5.

The source material describes this as the second serious incident involving this channel in five months, but provides no further detail about the earlier incident. It also says that the self-hosted UpdraftCentral product, UpdraftPlus itself and its downloads were not affected by the breach, according to TeamUpdraft.

“The company said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected.”

— TeamUpdraft

The Number of Affected Sites Is Unknown

TeamUpdraft has not said how many customers or WordPress sites were affected, or confirmed the full extent of database access. The company’s statement that it believes attackers reached the customer database leaves the precise data accessed and copied unclear. Researchers have identified malicious plugin names and behavior, but the source material does not establish that every site connected to UpdraftCentral was targeted or compromised.

The key-revocation cutoff also needs care. Nethemba says version 1.26.13 deletes keys created before 12:07 UTC on October 18, while keys created between that time and 21:00 UTC may need manual removal. The material says TeamUpdraft’s stated cutoff was 22:00 BST, equivalent to 21:00 UTC. It does not provide a complete process for identifying every key’s creation time or confirm how many remain active.

Researchers say backdoor variants differ: some may hide from the plugin list, and an early variant can cause HTTP 500 errors before its token check runs. Cleanup advice may change as more variants are found. A site showing an error or lacking an obvious malicious plugin should not be treated as clear based on that alone.

Administrators Need to Check Each Site

TeamUpdraft’s next public updates and revised cleanup instructions will be important as the company continues its investigation. Site owners should consult the current versions of TeamUpdraft’s advisory and the Patchstack and Nethemba analyses, rather than relying on an earlier notice alone. The source material does not give a date for a final incident report or a complete count of affected customers.

Administrators using UpdraftPlus should install the applicable corrected version, then review whether the site has an UpdraftCentral connection and when its key was created. Where a key falls outside the corrected revocation range, follow current instructions for removing it manually. If a suspicious plugin or account is found, treat the site as compromised: updating UpdraftPlus alone is not remediation, and removing a plugin may leave an unauthorized account behind.

TeamUpdraft recommends re-authorizing connected storage and rotating its access keys for sites managed through UpdraftCentral. Users should also check for unexpected plugins and accounts, including accounts with elevated permissions or unfamiliar email addresses. The company has reported the incident to the UK Information Commissioner’s Office; what further steps regulators or the vendor may take has not yet been announced.

Key Questions

What was exposed in the TeamUpdraft breach?

TeamUpdraft said the customer database contained contact and billing details, order history, hashed account passwords, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. It said payment-card data was not stored in that database.

Does updating UpdraftPlus remove a backdoor?

No. The corrected versions are intended to revoke certain exposed keys. They do not remove malicious plugins or accounts already installed on a WordPress site, so affected sites need a separate security review and cleanup.

Could a fully patched WordPress site be affected?

Yes. Patchstack said attackers used genuine UpdraftCentral keys to issue signed commands, so the attack did not depend on an unpatched software vulnerability. A site could be at risk if it had a compromised connection key.

What should a site owner check?

Install the applicable UpdraftPlus update, check for an UpdraftCentral connection and its key’s creation date, and follow the latest vendor and researcher guidance on revocation. Also inspect for unfamiliar plugins and accounts, and re-authorize connected storage and rotate its access keys if the site was managed through UpdraftCentral.

Source: ThorstenMeyerAI.com