WordPress Sites Face Backdoor Risk From Stolen UpdraftCentral Keys

🔍 Read the full analysis: WordPress Sites Face Backdoor Risk From Stolen UpdraftCentral Keys on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft confirmed on October 19 that attackers accessed its teamupdraft.com website and may have reached a customer database containing UpdraftCentral Cloud connection keys. Security researchers report that attackers used stolen keys to install backdoor plugins on WordPress sites, including fully patched sites, so updating UpdraftPlus alone may not remove an infection already in place.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said the access occurred over the weekend of October 17 and 18. The company believes the attackers reached a database containing customer names, email and billing addresses, order history, hashed account passwords, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft said it did not store payment card data; Stripe and PayPal process payments.

Patchstack’s analysis found that attackers used the keys to send a command to connected sites to upload a plugin. A site with a valid key accepts commands signed by the corresponding dashboard, and the command ran with the permissions of the user who created that connection. Patchstack said the commands were signed with genuine dashboard keys, meaning the activity did not require a flaw in the installed plugin. Sites on the latest version could also be affected.

TeamUpdraft released UpdraftPlus versions 1.26.13 (free) and 2.26.13 (Premium) to revoke affected keys. However, the update does not remove a malicious plugin or account that is already on a site. Nethemba reported that the earlier 1.26.12 release did not revoke keys because of a bug, and said version 1.26.13 removes keys created before 12:07 UTC on October 18. The researchers said some keys created later that day require manual removal.

Why Key Theft Reaches Live Sites

The incident shows how stolen administrative connection credentials can turn a breach of a service provider into a direct risk for connected websites. UpdraftCentral keys authorize commands; when a site has accepted one, an attacker with a genuine signing key can ask it to install a plugin without exploiting an unpatched software vulnerability. Updating the plugin therefore addresses only part of the exposure.

That distinction matters for site owners who may assume their websites are safe because WordPress and UpdraftPlus are current. Researchers say a planted backdoor can create an unauthorized account with elevated capabilities and a persistent login method. Removing the original plugin or revoking its key may not remove that account. Owners need to inspect the site itself and treat a confirmed backdoor as a compromise requiring broader cleanup.

Some users may not know they had enabled remote control. Nethemba said the option to add a site to UpdraftCentral is checked by default when connecting a TeamUpdraft account in settings; the source material says the Premium version behaves similarly. The incident also raises questions for organizations managing multiple sites through a central dashboard, where one exposed key could affect more than a single installation.

How UpdraftCentral Keys Work

UpdraftPlus is a WordPress backup plugin that includes an UpdraftCentral client. The client remains inactive until a connection key links a site to the hosted UpdraftCentral Cloud dashboard. Once connected, the dashboard can issue commands to that site. The source material says those keys do not expire, and Nethemba observed keys created in November 2025 being used shortly after the reported breach.

Patchstack counted 99 plugin names installed between the afternoon of October 18 and 09:23 on October 19. Names included “Site Health Cache,” “Seo Helper,” “Wp Forge” and “Js Clean.” The researchers identified a recurring plugin description, “Small maintenance toolkit: keeps option storage tidy,” as a possible indicator. According to the analysis, some variants create an account with an email address ending in example.org and the display name “Site Tools”; some also hide from the plugin list.

TeamUpdraft said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected. It said it closed the access route, signed users out, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. The company reported the incident to the UK Information Commissioner’s Office. Nethemba said it found the attack on three of its own sites and ruled out a modified plugin, weak cryptography and the older forgery vulnerability CVE-2026-10795, which was fixed in June 2026.

“The commands are correctly encrypted and signed with genuine dashboard private keys.”

— Patchstack

Affected Accounts and Sites Unknown

TeamUpdraft has not said how many customers or WordPress sites were affected, or how many stolen keys were used. The company’s investigation is ongoing, and the available source material does not establish whether every plugin installation identified by researchers is malicious or whether all affected site owners have been notified.

There is also a key-revocation gap described by Nethemba. The firm said version 1.26.13 deletes keys created before 12:07 UTC on October 18, while keys created between 12:07 and 21:00 UTC that day are not removed automatically. TeamUpdraft’s stated cutoff was 22:00 British Summer Time, equivalent to 21:00 UTC. Owners may need to establish when their connection keys were created and remove any that fall within the gap.

The number and behavior of backdoor variants may change as researchers continue examining the incident. Some early versions reportedly caused HTTP 500 errors before reaching their token check. Nethemba and Patchstack warn against repairing such a plugin, because doing so could activate its malicious behavior; they advise removing it. Exact remediation steps may also depend on the site and the variant present.

Check Keys and Inspect Sites

TeamUpdraft users should install the current UpdraftPlus release and consult the company’s latest incident advisory for instructions on reviewing and reauthorizing connections. Those who used UpdraftCentral to access a site should also review connected services and, where advised, reauthorize storage accounts and rotate their access keys. The source material says backups sent directly to a user’s own Google Drive, Dropbox or Amazon S3 were not affected, but recommends reauthorization and key rotation when UpdraftCentral was used to access the site.

Site owners should inspect installed plugins and user accounts for unfamiliar entries, including plugins with the reported description and accounts using the “Site Tools” display name. A suspected backdoor should be removed rather than repaired, and an affected site should be handled as compromised. Because the published cleanup guidance is still changing, owners should use current instructions from TeamUpdraft, Patchstack and Nethemba rather than relying only on the plugin update.

TeamUpdraft’s investigation and the researchers’ analysis are ongoing. Further information about the number of affected accounts and sites, the attack’s full scope and any additional cleanup requirements has not yet been reported in the supplied material.

Key Questions

Does installing UpdraftPlus 1.26.13 remove a backdoor?

No. The update is intended to revoke affected UpdraftCentral keys, but it does not remove a malicious plugin or account already installed on a site. Site owners need to inspect and clean the site separately.

Can a fully patched WordPress site still be affected?

Yes. Patchstack said attackers used genuine stolen dashboard keys to send signed commands, so the activity did not require an unpatched plugin vulnerability. A site connected to UpdraftCentral could be at risk even if its software was current.

What information did TeamUpdraft say may have been exposed?

The company said the database included customer names, email and billing addresses, order history, hashed passwords, two-factor authentication settings and connection keys. It said payment card data was not stored there and payments were handled by Stripe and PayPal.

What should I check on my site?

Install the current UpdraftPlus version, review UpdraftCentral connections and check for unfamiliar plugins or user accounts. If a backdoor is found, researchers advise removing it rather than repairing it, then following current cleanup guidance from TeamUpdraft and the security firms.

Source: ThorstenMeyerAI.com