A Guide To The Stolen UpdraftCentral Key Risk For WordPress Sites

🔍 Read the full analysis: A Guide To The Stolen UpdraftCentral Key Risk For WordPress Sites on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get hardware and tech essentials delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft disclosed a security breach on October 19 after attackers accessed its teamupdraft.com website and, the company believes, its customer database, which held keys for controlling connected WordPress sites through UpdraftCentral Cloud. Security researchers say attackers used stolen keys to install backdoor plugins, including on sites running current software versions; updating UpdraftPlus can revoke some exposed keys, but it does not remove a backdoor already on a site.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said the attackers accessed its website over the weekend of October 17 and 18. The company believes they reached a database containing customer names, email and billing addresses, order history, hashed account passwords, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft said it did not store payment card data; Stripe and PayPal process payments.

According to TeamUpdraft, the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected. The company released UpdraftPlus 1.26.13 and 2.26.13 to revoke exposed UpdraftCentral keys. However, security firm Nethemba reported that the preceding 1.26.12 release did not revoke keys as intended, and that version 1.26.13 does not remove every key created during the incident window. Some keys may need to be deleted manually.

Patchstack’s analysis found attackers used legitimate, signed dashboard commands to upload and activate plugins. It counted 99 plugin names installed between the afternoon of October 18 and 09:23 on October 19. That figure is a count of distinct names, not a confirmed total of infected sites. TeamUpdraft has not disclosed how many customers or websites may be affected.

Why Stolen Keys Could Install Backdoors

UpdraftCentral keys let a connected site accept commands from the dashboard, including commands to install plugins. Patchstack said the commands used in this incident were correctly signed with genuine dashboard keys, so the plugin’s normal security checks accepted them. Researchers said the attack did not require a software vulnerability and could affect fully patched sites with exposed keys.

That makes this a credential and access-control incident, not just a matter of installing the latest plugin release. A site may remain compromised after the key is revoked or UpdraftPlus is updated: the backdoor plugin and any account it created can persist independently. Site owners who used UpdraftCentral need to check both the connection and the site itself.

The backdoor behavior described by Patchstack and Nethemba includes creating unauthorized accounts, granting them elevated capabilities and using persistent login cookies. Some variants may hide from the plugin list. Researchers also warned that one early variant can cause HTTP 500 errors before its activation token is checked; repairing the error could allow the backdoor to run. This is why a broken plugin matching the reported indicators should be removed and investigated, rather than repaired in place.

How the UpdraftCentral Connection Works

UpdraftPlus is a WordPress backup plugin that includes a client for UpdraftCentral. When a site is connected to the hosted UpdraftCentral Cloud dashboard, its connection key allows the dashboard to send commands to that site. TeamUpdraft’s settings reportedly enable the option to add a website to remote UpdraftCentral control by default when connecting an account. Nethemba said keys do not expire automatically and reported seeing keys created in November 2025 used after the breach.

TeamUpdraft says it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also reported the incident to the UK Information Commissioner’s Office. The company said backups stored in customers’ own destinations, such as Google Drive, Dropbox or Amazon S3, were not affected. It recommends re-authorizing those storage connections and rotating their access keys if UpdraftCentral was used to access the site.

Nethemba said it found the attack on three of its own sites and attributed the activity to keys leaked from the UpdraftCentral Cloud environment. It said its investigation ruled out a modified plugin, weak cryptography and the older vulnerability CVE-2026-10795, which was fixed in UpdraftPlus 1.26.5 in June. The incident follows another serious issue involving this channel five months earlier, according to the source material.

“The commands are correctly encrypted and signed with genuine dashboard private keys.”

— Patchstack

Unresolved Scope and Key Revocation

The number of affected customers and sites is unknown. TeamUpdraft has not published a count, and the 99 plugin names reported by Patchstack do not establish how many individual websites were compromised. It is also unclear how many stolen keys were used, or whether all unauthorized access has been identified and removed.

Nethemba reported that version 1.26.13 removes keys created before 12:07 UTC on October 18, while keys created between 12:07 and 21:00 UTC that day are not deleted by the update and must be handled manually. The source material says TeamUpdraft’s stated cutoff was 22:00 BST, equivalent to 21:00 UTC. Site owners may not know when a connection key was created. Cleanup recommendations may also change as researchers identify additional backdoor variants.

The company’s statement that customer-owned backup storage was not affected does not settle whether credentials used to connect that storage through UpdraftCentral should be treated as exposed. TeamUpdraft recommends re-authorizing storage and rotating access keys when that dashboard was used. The full scope of data accessed or copied has not been stated.

Checks for Site Owners

TeamUpdraft’s incident advisory and the latest Patchstack and Nethemba analyses are the primary sources for updated remediation steps. Site owners should install the appropriate UpdraftPlus update, review UpdraftCentral connections and remove exposed keys that the update does not revoke. They should also inspect plugins and user accounts for unauthorized additions, including plugins with descriptions matching the reported backdoor indicators, and treat a site where a backdoor was found as compromised.

Where UpdraftCentral was used to reach a site, owners should follow TeamUpdraft’s advice to re-authorize connected backup storage and rotate its credentials. Because backdoor variants and cleanup guidance may change, administrators should check current vendor and researcher instructions rather than relying only on the update. TeamUpdraft’s investigation and disclosures about the number of affected accounts, sites and keys remain pending.

Key Questions

Does updating UpdraftPlus remove an installed backdoor?

No. The update is intended to revoke some exposed UpdraftCentral keys; it does not remove a backdoor plugin or unauthorized account already installed on a site. Those require separate inspection and cleanup.

Which UpdraftPlus versions did TeamUpdraft release?

TeamUpdraft released version 1.26.13 for the free plugin and 2.26.13 for Premium. Nethemba reported that 1.26.12 did not revoke keys as intended and that some keys from the incident period may still require manual deletion.

Were all WordPress sites running UpdraftPlus affected?

No such conclusion has been established. The reported risk concerns sites connected to UpdraftCentral using exposed keys. TeamUpdraft has not disclosed how many sites were affected, and the presence of UpdraftPlus alone does not confirm a compromise.

What information did TeamUpdraft say was in the database?

The company said it contained names, email and billing addresses, order history, hashed passwords, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. It said it held no payment card data; Stripe and PayPal handle payments.

Were customer backup files exposed?

TeamUpdraft said backups stored in customers’ own destinations, such as Google Drive, Dropbox or Amazon S3, were not affected. It recommends re-authorizing those storage connections and rotating access keys if UpdraftCentral was used to access the site.

Source: ThorstenMeyerAI.com