How The UpdraftCentral Key Issue Puts WordPress Sites In The Crosshairs

🔍 Read the full analysis: How The UpdraftCentral Key Issue Puts WordPress Sites In The Crosshairs on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on office and shipping supplies

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft said on October 19, 2026, that attackers had accessed its website and likely reached a customer database containing UpdraftCentral Cloud connection keys, which can authorize commands on connected WordPress sites. Researchers report that stolen keys were used to install backdoor plugins, so updating UpdraftPlus may revoke some keys but does not remove an infection already on a site.

According to TeamUpdraft’s incident notice, the attackers accessed teamupdraft.com over the weekend of October 17 and 18. The company believes they reached a database containing customer names, email and billing addresses, order history, hashed account passwords, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft said payment-card data was not stored in that database; payments are handled by Stripe and PayPal.

TeamUpdraft says the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected. It released UpdraftPlus versions 1.26.13 and 2.26.13 to revoke exposed keys. But the fix has limits: security firm Nethemba found the earlier version 1.26.12 did not revoke keys as intended, and says version 1.26.13 removes keys created before 12:07 UTC on October 18. Some keys created later that day may require manual deletion.

Patchstack’s analysis found attackers used validly signed commands to upload and activate plugins, including ones named “Site Health Cache” and “Seo Helper.” The backdoors can create unauthorized accounts with elevated capabilities and log attackers in using persistent cookies. Researchers say some variants hide from the plugin list, and removing the plugin alone may not remove the account it created. Nethemba and Patchstack advise removing, rather than repairing, a suspicious plugin that causes HTTP 500 errors, because restoring it could allow its backdoor code to run.

Stolen Keys Can Control Connected Sites

The incident matters because the exposed keys were not merely login credentials for TeamUpdraft accounts. A connected site accepts commands signed with its UpdraftCentral key, including commands to install a plugin. Patchstack says the attackers used genuine dashboard keys, so the commands passed the plugin’s checks; no software vulnerability was required. That means a site could be fully updated and still be affected if it trusted a stolen key.

Researchers also point to two factors that complicate cleanup. The option to add a site to UpdraftCentral is ticked by default when connecting a TeamUpdraft account, according to the source reports, and keys do not expire. Nethemba said it found keys created in November 2025 being used after the breach. Site owners may therefore need to investigate connections they do not recall creating and check for unauthorized users as well as unfamiliar plugins.

TeamUpdraft says it signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also recommends re-authorizing external storage and rotating its access keys if UpdraftCentral was used to access a site. Backups stored directly in services such as Google Drive, Dropbox or Amazon S3 were not affected according to the company, but connected access credentials may warrant review.

How UpdraftCentral Keys Work

UpdraftPlus includes a client for UpdraftCentral, a hosted dashboard used to manage multiple WordPress sites. The client remains dormant until a site receives a connection key. Once connected, the site can act on commands authenticated with that key, with permissions tied to the user who created it. That design allows remote site management, but it also means a stolen key can be misused without exploiting a flaw in the plugin.

Nethemba, which said it found the attack on three of its own sites, attributed the activity to keys exposed from the UpdraftCentral Cloud environment. It said its analysis ruled out a modified plugin, weak cryptography and the older key-forgery issue CVE-2026-10795, which was fixed in June in version 1.26.5. The source report describes the latest incident as a second serious event involving this channel in five months; details of the earlier event are not provided here.

“The company believes attackers reached its customer database.”

— TeamUpdraft

Breach Scope and Key Gaps

TeamUpdraft has not said how many customers or WordPress sites were affected, how many records attackers accessed, or how many sites received backdoors. It has not published a complete account of how the attackers first entered the website or how long they had access. The company says it reported the incident to the UK Information Commissioner’s Office, but the outcome of that report is not stated.

The key revocation is also not a complete site-cleanup measure. Nethemba reports that keys created between 12:07 and 21:00 UTC on October 18 are not covered by the deletion it observed in version 1.26.13 and may need to be removed manually. TeamUpdraft’s stated cutoff was 22:00 BST, or 21:00 UTC. Connections made after the cutoff are left in place. Researchers say backdoor variants differ, and guidance may change as more are identified; the number and exact range of affected keys remain uncertain.

Check Keys, Plugins and Accounts

Site owners should install the applicable UpdraftPlus update, then review TeamUpdraft’s current advisory for instructions on identifying and removing exposed connections. Updating alone should not be treated as proof that a site is clean: check plugin directories and the WordPress user list for unfamiliar entries, including accounts with names resembling operational or media staff and addresses ending in @example.org. A suspicious plugin may use the description “Small maintenance toolkit: keeps option storage tidy,” but researchers warn that names and hiding behavior vary.

If a backdoor or unauthorized account is found, treat the site as compromised and follow current incident-response guidance from TeamUpdraft and security researchers. Review and rotate credentials for connected storage where advised, and investigate whether the key was created during the uncovered window. TeamUpdraft’s investigation and researchers’ cleanup guidance remain ongoing, so administrators should consult the latest versions of the company advisory and Patchstack and Nethemba analyses before deciding a site has been secured.

Key Questions

Does updating UpdraftPlus remove a backdoor?

No. The released updates are intended to revoke some UpdraftCentral keys. They do not remove a backdoor plugin or unauthorized account that has already been installed.

Which UpdraftPlus versions did TeamUpdraft release?

TeamUpdraft released version 1.26.13 for the free plugin and 2.26.13 for Premium. The source report says version 1.26.12 failed to revoke keys as intended; consult TeamUpdraft’s current advisory for the latest instructions.

Were payment-card details exposed?

TeamUpdraft said card data was not stored in the affected customer database. It said payments are handled by Stripe and PayPal.

Could a fully patched WordPress site be affected?

Yes. Patchstack says attackers used valid UpdraftCentral keys to issue commands, so a plugin vulnerability was not needed. A connected, fully patched site could still accept a command authorized by a stolen key.

What should site owners check beyond the plugin update?

Review UpdraftCentral connections and keys, inspect installed plugins and WordPress accounts for unfamiliar entries, and follow current vendor and researcher guidance if anything suspicious appears. Also review external storage access if UpdraftCentral was used to reach the site.

Source: ThorstenMeyerAI.com