🔍 Read the full analysis: The UpdraftCentral Key Scare: WordPress Backdoors And An Incomplete Fix on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
TeamUpdraft disclosed that attackers accessed its website and likely reached a customer database containing UpdraftCentral connection keys. Researchers say stolen keys were used to install backdoor plugins on WordPress sites, including sites running current software. UpdraftPlus 1.26.13 revokes some exposed keys, but site owners must separately check for and remove backdoors and affected accounts.
TeamUpdraft, the company behind the UpdraftPlus WordPress backup plugin, said on October 19 that attackers accessed its website and likely reached a customer database containing UpdraftCentral Cloud connection keys. Security researchers report that attackers used those keys to install backdoor plugins on WordPress sites; the company’s updated plugin revokes some keys, but does not remove backdoors already installed.
TeamUpdraft said the attackers accessed teamupdraft.com over the weekend of October 17–18 and that its investigation indicates they reached customer records. The records included names, email and billing addresses, order history, hashed account passwords, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft said it did not store payment-card data; payments are handled by Stripe and PayPal.
The stolen UpdraftCentral keys could authorize commands sent to connected WordPress sites. Patchstack’s analysis says attackers used a command to upload and activate plugins. Because the commands were signed with genuine dashboard keys, the affected sites did not need to be running a vulnerable or outdated version of UpdraftPlus. Patchstack counted 99 plugin names used between the afternoon of October 18 and 09:23 on October 19; that is a count of names observed, not a count of affected sites.
TeamUpdraft released UpdraftPlus 1.26.13 and Premium 2.26.13 to revoke exposed keys. Nethemba’s code review says the preceding version, 1.26.12, failed to delete the intended keys. The later release removes keys created before 12:07 UTC on October 18, according to Nethemba, but keys created between then and 21:00 UTC are not automatically removed and require manual deletion. Updating also does not clean an infected site.
Infographic 01 · UpdraftCentral key compromise
Stolen keys, signed commands, backdoored sites.
Keys leaked from TeamUpdraft's customer database let attackers send valid commands to connected WordPress sites. No plugin vulnerability was needed.
Timeline
Times as reported by the named source.
- 17 Oct, evening · Attacker has access to teamupdraft.com (Nethemba)
- 18 Oct, afternoon · First backdoor plugin installed via a signed UpdraftCentral command (Patchstack)
- 19 Oct, 09:23 · Latest backdoor install seen; 99 plugin names in total (Patchstack)
- 19 Oct, 13:00 UTC · TeamUpdraft publishes its incident advisory (Patchstack)
- 19 Oct · UpdraftPlus 1.26.12: key revocation ships, but a bug deletes no key (Nethemba)
- 19 Oct, evening · 1.26.13 fixes it; keys made 18 Oct 12:07–21:00 UTC still remain (Nethemba)
Patchstack and Nethemba analyses are being updated as new variants appear.
What the update does, and doesn’t
Based on Nethemba’s code review and TeamUpdraft’s advisory.
- 1
1.26.12 / 2.26.12
Meant to revoke the stolen keys. Because of a bug, it deleted none (Nethemba).
- 2
1.26.13 / 2.26.13
Revokes UpdraftCentral Cloud keys created before 12:07 UTC on 18 Oct.
- 3
Gap: 18 Oct, 12:07–21:00 UTC
Keys created in this window are not revoked, although the vendor's cutoff is 21:00 UTC.
- 4
Backdoors stay
Revoking a key does not remove an installed backdoor plugin or the account it created.
- 5
Guidance still changing
New backdoor variants keep turning up; vendor and researcher advisories are being updated.
Sources: TeamUpdraft (19 Oct 2026); Patchstack; Nethemba (updated 20 Oct 2026).
Powered by Thorsten Meyer AI
Stolen Keys Could Install Site Backdoors
The incident matters because the keys functioned as authority to issue commands to connected sites, rather than merely as account credentials. Researchers say attackers used that access to add plugins that could create attacker-controlled accounts and provide persistent access. A site running the latest UpdraftPlus version could still be affected if it had a compromised connection key.
Removing the malicious plugin alone may not be enough. The described backdoor can create an account that remains after the plugin is deleted, and some versions hide from the WordPress plugin list. The researchers also report that a variant can cause HTTP 500 errors before reaching its token check; they warn administrators not to repair that error, because doing so could activate the backdoor. These findings make the incident a site-cleanup issue as well as a credential-revocation issue.
For site owners, the practical consequence is that an update is one part of response, not proof that a site is clean. Administrators may need to inspect plugins and users, remove suspicious components and accounts, and review credentials for connected services. TeamUpdraft recommends re-authorizing external storage and rotating access keys if UpdraftCentral was used to access a site.
Products Worth Considering
Dell UltraSharp 27 Thunderbolt Hub Monitor (U2726DER), QHD
Samsung 32-Inch Odyssey G5 QHD Gaming Monitor (G50F)
Dell UltraSharp U4025QW 40-Inch Curved 5K2K WUHD LED Monitor
As an affiliate, we earn on qualifying purchases.
How UpdraftCentral Keys Were Used
UpdraftPlus includes a client for UpdraftCentral, a dashboard used to manage multiple WordPress sites. The client remains inactive until a connection key is provided. According to Patchstack, commands signed with the corresponding key are accepted and run with the permissions of the user who created it. The researchers say this allowed attackers with stolen legitimate keys to upload and activate plugins without exploiting a software flaw.
Nethemba, which said it found the attack on three of its own sites, attributed the activity to keys leaked from the UpdraftCentral Cloud environment and said the commands came from the attacker’s server. It ruled out a modified plugin, weak cryptography and the older key-forgery issue CVE-2026-10795, which had been fixed in version 1.26.5 in June. Nethemba also said connection keys do not expire; it observed keys created in November 2025 being used after the breach.
TeamUpdraft said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected. It said it closed the access route, signed users out, disconnected UpdraftVault sites, replaced UpdraftClone keys, rotated keys with payment providers and reported the incident to the UK Information Commissioner’s Office.
“The UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected.”
— TeamUpdraft, in its incident advisory
Affected Accounts and Sites Still Unknown
TeamUpdraft has not disclosed how many customers, connection keys or WordPress sites were affected. The company said it believes attackers reached its customer database, while researchers identified specific attack activity on sites they examined; the full extent of the compromise remains unreported.
It is also not clear from the available statements how many sites received a backdoor, whether every malicious plugin variant has been identified, or how many keys fall within the October 18 period that Nethemba says requires manual deletion. The company and researchers have said cleanup guidance may change as additional variants are found. Their findings should not be read as proof that every UpdraftPlus installation or every customer account was compromised.
Check Keys, Plugins and Accounts
Administrators using UpdraftPlus should install the current vendor release and consult the latest TeamUpdraft advisory alongside the Patchstack and Nethemba analyses. They should determine whether their sites were connected to UpdraftCentral, check when connection keys were created, and manually remove keys that fall within the period not covered by automatic revocation.
Site owners should also inspect plugin files and user accounts for the indicators described by researchers, including plugins with the description “Small maintenance toolkit: keeps option storage tidy” and unexpected accounts with elevated permissions. If a backdoor is found, researchers advise treating the site as compromised rather than assuming that updating or deleting the visible plugin resolves the intrusion. TeamUpdraft’s investigation and guidance remain ongoing; the company has not announced a final count of affected customers or sites.
Key Questions
Does updating UpdraftPlus remove a backdoor?
No. UpdraftPlus 1.26.13 and 2.26.13 revoke some connection keys, but the update does not remove a malicious plugin or an account it created. Affected sites need separate inspection and cleanup.
Which versions include the key revocation?
TeamUpdraft released version 1.26.13 for the free plugin and 2.26.13 for Premium. Nethemba says the earlier 1.26.12 release did not delete the intended keys.
Were all exposed keys revoked automatically?
No. Nethemba says the update removes keys created before 12:07 UTC on October 18, while keys created from then until 21:00 UTC require manual deletion. Administrators should check the current vendor guidance for instructions and timing.
Was payment-card information exposed?
TeamUpdraft said it did not store card data and that Stripe and PayPal handle payments. The company said customer records did include names, contact and billing addresses, order history, hashed passwords, two-factor settings and product connection keys.
Can a fully patched WordPress site be affected?
Yes. Patchstack says attackers used valid, stolen UpdraftCentral keys to issue commands, so the attack did not depend on an outdated UpdraftPlus version. A patched site could still be at risk if it was connected with an exposed key.
Source: ThorstenMeyerAI.com
