Why WordPress Sites Need A Closer Look At UpdraftCentral Keys

🔍 Read the full analysis: Why WordPress Sites Need A Closer Look At UpdraftCentral Keys on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft said on October 19, 2026, that attackers had accessed its website and may have reached a customer database containing UpdraftCentral Cloud connection keys. Security researchers report that stolen keys were used to send commands to WordPress sites and install backdoor plugins, including on sites with up-to-date software. The company has released UpdraftPlus updates intended to revoke some exposed keys, but updating alone does not remove an installed backdoor.

In its incident notice, TeamUpdraft said the attackers accessed teamupdraft.com over the weekend of October 17–18 and that the customer database may have been reached. The company said the database contained customer names, email addresses, billing addresses, order histories, password hashes, two-factor authentication settings, and keys associated with UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft said it did not store payment card data; Stripe and PayPal handled payments.

UpdraftCentral Cloud lets customers manage multiple WordPress sites from a hosted dashboard. When a site is connected, its UpdraftPlus client can accept commands signed with the corresponding key. Patchstack, which analysed the activity, said attackers used a command to upload a plugin that WordPress then installed and activated. It reported 99 plugin names observed between the afternoon of October 18 and 09:23 on October 19. Names included “Site Health Cache” and “Seo Helper”; the description “Small maintenance toolkit: keeps option storage tidy” is a reported indicator.

TeamUpdraft released UpdraftPlus versions 1.26.13 (free) and 2.26.13 (Premium) to address the key revocation issue. Nethemba’s review says the earlier 1.26.12 release did not delete keys as intended, while 1.26.13 removes keys created before 12:07 UTC on October 18. Nethemba says keys created between 12:07 and 21:00 UTC that day are not automatically removed and must be deleted manually. TeamUpdraft’s stated cutoff is 22:00 British Summer Time, equivalent to 21:00 UTC.

Why a Valid Key Can Become a Backdoor

The incident matters because the exposed credentials were not merely passwords for customer accounts: they could authorize commands on connected sites. Patchstack said the uploaded commands carried genuine signatures, so the plugin’s authentication checks accepted them. This meant an attacker with a valid stolen key could use the intended remote-management function; researchers said a software vulnerability was not required for the reported installations. Sites running the latest version could still be affected if they had a compromised connection key.

Researchers describe the reported backdoor plugins as capable of creating privileged accounts and allowing persistent access. Patchstack said some variants used an account with the Editor role plus capabilities including manage_options and install_plugins, and could log in using a persistent cookie. Some variants reportedly concealed themselves from the plugin list. Removing the UpdraftPlus key or updating the plugin does not, by itself, remove a malicious plugin or account already added to a site.

The exposure may be easy to miss: Nethemba said the option to add a site to UpdraftCentral when connecting a TeamUpdraft account is selected by default. The researchers also reported that keys do not expire, and found keys created in November 2025 used after the breach. Site owners may therefore need to inspect connections even if they did not recently set one up.

How TeamUpdraft Says It Responded

TeamUpdraft said it closed the access route, signed out all accounts, disconnected all UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also said it reported the incident to the UK Information Commissioner’s Office. The company said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected. It said backups stored in customers’ own services, such as Google Drive, Dropbox or Amazon S3, were not affected, though it recommends re-authorizing those storage connections and rotating their access keys if UpdraftCentral was used to access the site.

Nethemba said it found the attack on three of its own sites and attributed the activity to leaked UpdraftCentral Cloud keys. It said its analysis ruled out a modified plugin, weak cryptography and the older issue CVE-2026-10795, which it said was fixed in June in version 1.26.5. These are researchers’ findings; TeamUpdraft’s public notice does not state how the attackers obtained access to the website or database.

The source material describes the breach as the second serious incident involving this channel in five months, but does not provide details about the earlier incident. That history is not enough by itself to establish whether the events were connected.

“The UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected.”

— TeamUpdraft, in its incident notice

How Many Sites Were Reached

TeamUpdraft has not said how many customers or WordPress sites were affected, how attackers initially accessed teamupdraft.com, or whether the customer database was fully copied. The company’s statement says it believes attackers reached the database; the extent of that access remains unconfirmed in the supplied information.

The scope of key exposure also needs careful checking. Nethemba reports a gap in automatic revocation for keys created during part of October 18, and researchers’ cleanup guidance may change as additional backdoor variants are identified. It is not clear from the available material how many keys fall within that interval, or how many affected sites already have persistent accounts or other changes.

TeamUpdraft said customer passwords were stored as hashes and payment card details were not held in its database. Those points do not establish whether other account information was accessed or misused. The company has not reported a confirmed count of affected records or described any further findings from its investigation.

What Site Owners Should Check

Site owners using UpdraftPlus should install the current applicable version and review TeamUpdraft’s latest advisory alongside the Patchstack and Nethemba analyses. They should check whether their site was connected to UpdraftCentral Cloud, identify when its key was created, and manually remove keys that fall within the interval Nethemba says the update does not revoke. If UpdraftCentral was used to reach backup storage, TeamUpdraft recommends re-authorizing that storage and rotating its access keys.

Owners should also inspect for unfamiliar plugins and administrator-level changes, including accounts with unusual names, “Site Tools” as a display name, or an @example.org email address. These are reported indicators, not a complete list of every variant. If a suspicious plugin is found, Patchstack and Nethemba warn against trying to repair a variant that causes HTTP 500 errors: they say repairing it may activate the backdoor. The supplied guidance says to remove it and treat a site where a backdoor was found as compromised, while following updated instructions from the vendor and researchers.

TeamUpdraft’s investigation and the researchers’ analysis remain ongoing. Further notices may clarify the number of affected customers, the access route, and any changes to recommended cleanup steps.

Key Questions

What happened in the TeamUpdraft breach?

TeamUpdraft said attackers accessed teamupdraft.com over the weekend of October 17–18, 2026, and may have reached a customer database containing UpdraftCentral Cloud keys. Researchers report that keys were used to send commands that installed backdoor plugins on WordPress sites.

Does updating UpdraftPlus remove a backdoor?

No. The update is intended to revoke some exposed keys. It does not automatically remove a plugin or account that may already have been installed on a site.

Which UpdraftPlus versions address key revocation?

TeamUpdraft released versions 1.26.13 for the free plugin and 2.26.13 for Premium. Nethemba says 1.26.13 revokes keys created before 12:07 UTC on October 18, while keys created from 12:07 to 21:00 UTC that day require manual removal.

Were backups in Google Drive or Amazon S3 affected?

TeamUpdraft said backups stored in customers’ own services, including Google Drive, Dropbox and Amazon S3, were not affected. If UpdraftCentral was used to access a site, the company recommends re-authorizing the storage connection and rotating its access keys.

How many customers or sites were affected?

TeamUpdraft has not disclosed a count of affected customers or sites. The number of records accessed and the full reach of the reported backdoor activity remain unclear.

Source: ThorstenMeyerAI.com