WordPress Backdoors And Stolen UpdraftCentral Keys: The Fix Has A Gap

🔍 Read the full analysis: WordPress Backdoors And Stolen UpdraftCentral Keys: The Fix Has A Gap on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get smart everyday buys delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft said on October 19, 2026, that attackers had accessed its website and likely reached a customer database containing UpdraftCentral connection keys, which can authorize commands on linked WordPress sites. Researchers say attackers used stolen keys to install backdoor plugins, and that the latest UpdraftPlus update does not remove those plugins or revoke every key created during the affected period.

The company, which makes the UpdraftPlus backup plugin, said the website intrusion happened over the weekend of October 17–18. Its incident post said the accessed database held names, email addresses, billing addresses, order history, password hashes, two-factor authentication settings and keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft said payment card details were not stored there; Stripe and PayPal handle payments.

TeamUpdraft released UpdraftPlus 1.26.13 and 2.26.13 Premium to revoke affected UpdraftCentral keys. The preceding version, 1.26.12, was intended to revoke keys but, according to security firm Nethemba’s code review, deleted none because of a bug. Nethemba says version 1.26.13 removes keys created before 12:07 UTC on October 18, but leaves keys created from 12:07 to 21:00 UTC that day. The company’s stated cutoff was 22:00 British Summer Time, equivalent to 21:00 UTC.

Security firms Patchstack and Nethemba reported that attackers used valid, signed dashboard commands to upload and activate plugins. Patchstack counted 99 different plugin names installed between the afternoon of October 18 and 09:23 on October 19. A recurring description was “Small maintenance toolkit: keeps option storage tidy.” The count is a report of observed plugin names, not a confirmed total of affected sites.

Why a Dashboard Key Can Install Backdoors

The incident shows how a legitimate remote-management feature can become an attack route when its authorization keys are stolen. According to Patchstack, a connected site accepts correctly signed commands from UpdraftCentral, including commands to upload and activate a plugin. The attacker therefore did not need to exploit a flaw in the installed UpdraftPlus code: the commands passed the plugin’s checks using genuine keys. Patchstack says fully patched sites could be affected.

The reported backdoor behavior raises the stakes beyond an unwanted plugin. Patchstack and Nethemba say variants can create an account, grant it powerful capabilities and use a persistent login cookie that bypasses the ordinary login form. Removing the plugin alone may not remove the account, and some variants hide from the WordPress plugin list. TeamUpdraft’s key revocation addresses access through affected keys, but it does not establish that a site is clean. Site owners may need to check for unauthorized accounts and other persistence, following current vendor and researcher guidance.

The exposure also may not be obvious to administrators. The source report says connecting a TeamUpdraft account in UpdraftPlus settings has the option to add the site to UpdraftCentral enabled by default. Nethemba also reports that keys do not expire, and observed keys created in November 2025 being used after the breach. A key set up long before the incident could therefore remain relevant.

How the Breach Reached WordPress Sites

UpdraftPlus includes an UpdraftCentral client that remains dormant until a connection key is added. Once connected, it can carry out commands authorized by that key, with permissions tied to the user who created it. That design supports managing multiple WordPress installations from one dashboard, but also means a stolen valid key can authorize actions without a software vulnerability being exploited.

Nethemba said it found the attack on three of its own sites and attributed the activity to keys leaked from the UpdraftCentral Cloud environment, used from an attacker-controlled server. It said it ruled out a modified plugin, weak cryptography and the older forgery vulnerability CVE-2026-10795, which had been fixed in June in version 1.26.5. The source report describes this as the second serious incident involving this channel in five months.

TeamUpdraft said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected. It also said backups sent directly to customers’ own storage, such as Google Drive, Dropbox or Amazon S3, were not affected. However, where UpdraftCentral was used to access a site, the company recommends re-authorizing that storage and rotating its access keys.

““The commands are correctly encrypted and signed with genuine dashboard private keys.””

— Patchstack

Affected Sites and Remaining Keys

TeamUpdraft has not disclosed how many customers or WordPress sites were affected, or how many stolen keys were used. The exact extent of unauthorized access and whether data beyond the reported database contents was reached are not specified in the source material. Nethemba’s findings identify a key-creation window that version 1.26.13 reportedly does not cover; the number of keys in that window is unknown.

It is also not clear how many backdoor variants remain in circulation. Researchers describe multiple plugin names and behaviors, including variants that hide themselves and one early variant that causes HTTP 500 errors before its token check. The source material says cleanup guidance is changing as new variants are found. TeamUpdraft’s statement that the plugin and downloads were not affected is separate from the confirmed use of stolen dashboard keys to command connected sites.

Update, Revoke, Then Inspect

Site owners using UpdraftPlus should install the applicable 1.26.13 release and consult the current TeamUpdraft advisory alongside Patchstack and Nethemba’s technical analyses. The update is not a cleanup tool: administrators should check for suspicious plugins and accounts, and treat a site where a backdoor is found as compromised. Nethemba says keys created in the unrecalled October 18 window need to be deleted manually.

TeamUpdraft said it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys, rotated keys with payment providers and reported the incident to the UK Information Commissioner’s Office. The company’s advisory and researchers’ findings remain the key sources for revised cleanup steps as the investigation develops. The number of affected customers and sites, and the full extent of any resulting access, have not yet been reported.

Key Questions

Does updating UpdraftPlus remove an installed backdoor?

No. The update is intended to revoke affected keys; it does not remove a backdoor plugin or an account already created on a site. Researchers advise checking for and removing malicious components using current cleanup guidance.

Which UpdraftPlus versions contain the stated key fix?

TeamUpdraft released UpdraftPlus 1.26.13 and 2.26.13 Premium. The source report says the previous 1.26.12 release did not revoke keys because of a bug.

Were all UpdraftCentral keys revoked by version 1.26.13?

Not according to Nethemba’s analysis. It says the release deletes keys created before 12:07 UTC on October 18, 2026, but not keys created between 12:07 and 21:00 UTC that day. Nethemba says those keys must be removed manually.

Were payment card details or customers’ own backups exposed?

TeamUpdraft said it did not store card data; Stripe and PayPal handle payments. It also said backups sent to customers’ own storage, including Google Drive, Dropbox or Amazon S3, were not affected. For sites accessed through UpdraftCentral, the company recommends re-authorizing storage and rotating access keys.

How many sites were affected?

TeamUpdraft has not stated how many customers or sites were affected. Patchstack’s count of 99 refers to different plugin names observed in the attack window, not a confirmed count of compromised sites.

Source: ThorstenMeyerAI.com