3 Things To Know About Stolen UpdraftCentral Keys And WordPress

🔍 Read the full analysis: 3 Things To Know About Stolen UpdraftCentral Keys And WordPress on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get privacy and security gear delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft said on October 19, 2026, that attackers accessed its website and likely reached a customer database containing UpdraftCentral Cloud connection keys, then used stolen keys to install backdoor plugins on connected WordPress sites. The company has released updated versions of UpdraftPlus to revoke some exposed keys, but updating the plugin does not remove a backdoor that may already be on a site.

In its incident post, TeamUpdraft said the attackers accessed teamupdraft.com over the weekend of October 17 and 18. The potentially exposed database included customer names, email and billing addresses, order history, hashed account passwords, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment card data; Stripe and PayPal process payments. It also said backups stored directly with services such as Google Drive, Dropbox or Amazon S3 were not affected.

Security firms reported that the keys were used to issue commands through UpdraftCentral’s WordPress client. Patchstack said it observed the command plugin.upload_plugin, which caused WordPress to install and activate an uploaded plugin. Because the commands were signed with genuine dashboard keys, Patchstack said the plugin’s checks passed; the activity did not require a software vulnerability or an outdated UpdraftPlus installation. Patchstack counted 99 plugin names used in installations between the afternoon of October 18 and 09:23 on October 19. That count is not a measure of the number of affected sites.

TeamUpdraft released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) after an earlier revocation attempt in version 1.26.12 failed, according to Nethemba’s code review. Nethemba said version 1.26.13 removes keys created before 12:07 UTC on October 18, but does not remove keys created between 12:07 and 21:00 UTC that day. The company has closed the access route, signed out accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers, according to its incident post. It said it reported the breach to the UK Information Commissioner’s Office.

Why Stolen Keys Could Control Sites

The incident matters because the exposed credentials were not ordinary login details: they authorized a cloud dashboard to send management commands to connected WordPress sites. According to Patchstack, a valid signed command could upload and activate a plugin under the permissions associated with the key. That allowed attackers to reach sites running current software without exploiting a flaw in the plugin itself.

Researchers said some installed plugins created administrator-like accounts, though the described accounts were assigned the Editor role along with additional capabilities such as manage_options and install_plugins. The backdoor could also create a persistent login cookie, according to the analyses. Removing the plugin may not remove the account it created, and some versions reportedly hid themselves from the plugin list. Site owners therefore cannot treat a successful update as proof that a site is clean.

The exposure may also affect users who do not recall enabling remote management. The UpdraftPlus connection setting reportedly has the option to add a site to UpdraftCentral checked by default when a TeamUpdraft account is connected. Nethemba also reported that keys did not expire automatically and found keys created in November 2025 used after the breach. Users need to check whether a connection existed and when its key was created.

How the UpdraftCentral Connection Works

UpdraftPlus is a WordPress backup plugin, while UpdraftCentral Cloud is a hosted dashboard for managing multiple WordPress sites. The UpdraftCentral client is included with copies of UpdraftPlus, but remains dormant until a site is connected with a key. TeamUpdraft said the breach affected the cloud service’s keys, not the UpdraftPlus downloads, the plugin itself or self-hosted UpdraftCentral.

Nethemba said it found the attack on three of its own sites and concluded that the keys came from the UpdraftCentral Cloud environment and were used from an attacker-controlled server. It said its analysis did not point to a modified plugin, weak cryptography or the earlier key-forgery vulnerability CVE-2026-10795, which it said was fixed in June in version 1.26.5. The key issue described here is the use of valid credentials obtained through the reported breach.

TeamUpdraft’s first replacement release, 1.26.12, was intended to revoke keys created before the incident. Nethemba said a bug meant it deleted no keys, prompting version 1.26.13 and a changelog note that the revocation was properly applied. The correction still has a time boundary: keys created in a later window on October 18 may need manual removal, according to Nethemba’s review.

“The commands are correctly encrypted and signed with genuine dashboard private keys.”

— Patchstack

Affected Sites and Cleanup Scope

TeamUpdraft has not said how many customers or WordPress sites were affected, or how many were reached by attackers. Patchstack’s count of 99 plugin names describes observed names, not a confirmed site total. The company has also not published a complete account of the attacker’s access or the full set of affected keys.

The precise exposure for an individual site may depend on whether it was connected to UpdraftCentral and when its key was created. Nethemba’s review identifies keys created from 12:07 to 21:00 UTC on October 18 that version 1.26.13 does not automatically delete; TeamUpdraft’s stated cutoff is 22:00 BST, equivalent to 21:00 UTC. The supplied information does not establish whether every key in that interval was stolen or used.

Cleanup advice may change as researchers identify additional backdoor variants. TeamUpdraft and the researchers warn that revoking keys is separate from removing malicious plugins, accounts and persistent access. A plugin that causes repeated HTTP 500 errors may still contain a backdoor, Nethemba and Patchstack said; attempting to repair it could allow the malicious code to run. Their guidance is to remove it rather than repair it.

What Site Owners Should Check

Site owners using UpdraftPlus should install the current version specified by TeamUpdraft and review the company’s latest advisory alongside the Patchstack and Nethemba analyses. They should check whether the site was connected to UpdraftCentral, confirm when its key was created, and manually revoke keys that fall outside the release’s automatic cutoff, following the vendor’s instructions.

Owners should also inspect plugins and user accounts for the indicators reported by researchers. These include plugin descriptions reading “Small maintenance toolkit: keeps option storage tidy”, suspiciously named plugins, and unexpected accounts with names such as data-ops43 or media-staff96 and an @example.org address. Those examples are indicators, not a complete list, and some variants may hide themselves. If a backdoor is found, the site should be treated as compromised and investigated beyond simply updating UpdraftPlus.

For sites connected to UpdraftCentral, TeamUpdraft recommends re-authorizing external storage connections and rotating their access keys. Its response and the researchers’ cleanup recommendations remain subject to updates as the investigation develops. The company has not announced a final affected-site count or a completion date for the response.

Key Questions

Does updating UpdraftPlus remove an installed backdoor?

No. The update is intended to revoke some exposed UpdraftCentral keys; it does not remove a malicious plugin or account already installed on a site. Affected sites need separate inspection and cleanup.

Which UpdraftPlus versions did TeamUpdraft release?

TeamUpdraft released 1.26.13 for the free plugin and 2.26.13 for Premium. Nethemba said an earlier release, 1.26.12, failed to delete keys because of a bug.

Were payment card details exposed?

TeamUpdraft said it did not store card data. Payments are handled by Stripe and PayPal. The company said the customer database did include personal and account-related information, including hashed passwords and two-factor authentication settings.

Were backups stored in Google Drive or Amazon S3 affected?

TeamUpdraft said backups sent directly to users’ own storage, including Google Drive, Dropbox and Amazon S3, were not affected. For sites accessed through UpdraftCentral, the company recommends re-authorizing storage and rotating access keys.

How many WordPress sites were affected?

TeamUpdraft has not disclosed a confirmed number of affected customers or sites. Patchstack reported 99 different plugin names among observed installations, but that figure does not establish how many sites were compromised.

Source: ThorstenMeyerAI.com