Can The UpdraftCentral Fix Stop Stolen Keys From Backdooring WordPress Sites?

🔍 Read the full analysis: Can The UpdraftCentral Fix Stop Stolen Keys From Backdooring WordPress Sites? on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get hardware and tech essentials delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft confirmed on October 19 that attackers accessed its teamupdraft.com website and likely reached a customer database containing UpdraftCentral Cloud connection keys. Researchers say stolen keys were used to install backdoor plugins on WordPress sites, including sites running current software; TeamUpdraft’s UpdraftPlus 1.26.13 update revokes some exposed keys, but does not remove backdoors already installed.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said the intrusion took place over the weekend of October 17 and 18. Its incident notice says the database may have contained customer names, email and billing addresses, order history, hashed account passwords, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment-card data; payments are handled by Stripe and PayPal. It has not disclosed how many customers or websites may be affected.

Patchstack’s analysis found that attackers used genuine UpdraftCentral keys to send a command that uploaded and activated a plugin. Because the command was signed with legitimate keys, the normal checks passed; the researchers said the attack did not require a software vulnerability. The malicious plugins could create an attacker-controlled account with elevated capabilities and provide a persistent login. Removing the plugin alone may not remove that account, and some variants reportedly hide from the WordPress plugin list.

TeamUpdraft released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) to revoke keys after an earlier version, 1.26.12, did not apply the revocation as intended, according to security firm Nethemba’s code review. Nethemba says version 1.26.13 removes keys created before 12:07 UTC on October 18, but keys created between 12:07 and 21:00 UTC that day require manual deletion. TeamUpdraft’s stated cutoff was 22:00 British Summer Time, equivalent to 21:00 UTC.

Why Key Revocation Is Not Cleanup

The incident shows how a trusted site-management connection can become a route to install code when its credentials are exposed. UpdraftCentral keys allow a connected WordPress site to accept signed management commands, including plugin installation. A site does not need to be running an outdated plugin for a valid stolen key to work, so ordinary software patching cannot by itself address this kind of access.

The response has two separate parts: revoke credentials that may still let an attacker issue commands, and investigate each connected site for changes already made. Updating UpdraftPlus handles only the first part, and even that is not complete for every key creation time, according to Nethemba. Site owners who find a backdoor should treat the site as compromised and follow current vendor and researcher guidance rather than assuming a plugin update has restored it.

How UpdraftCentral Keys Work

UpdraftPlus includes an UpdraftCentral client that can remain dormant until a site is connected to a central dashboard. TeamUpdraft’s account-connection settings have an option to add a website to UpdraftCentral that is ticked by default, according to the source report; Nethemba says the Premium version behaves similarly. A site owner may therefore have enabled a connection without separately setting out to use the dashboard.

Nethemba said it found the attack on three of its own sites and observed keys created in November 2025 being used after the breach. It reported that keys do not expire. The firm said it ruled out a modified plugin, weak cryptography and the older vulnerability CVE-2026-10795, fixed in UpdraftPlus 1.26.5 in June. The source report describes this as the second serious incident involving this channel in five months, but the available material does not give further details about the earlier incident.

TeamUpdraft said it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also reported the breach to the UK Information Commissioner’s Office. The company said backups stored in customers’ own services, such as Google Drive, Dropbox or Amazon S3, were not affected; for sites accessed through UpdraftCentral, however, it recommends reauthorizing storage and rotating access keys.

““The commands are correctly encrypted and signed with genuine dashboard private keys.””

— Patchstack

Affected Sites and Key Window

The number of affected customers and sites remains unknown. TeamUpdraft has not said how many records or keys attackers obtained, or how many websites received a malicious plugin. The material also does not establish whether every exposed key was used.

The precise scope of key revocation is still a concern. Nethemba says keys created during the October 18 window from 12:07 to 21:00 UTC are not removed automatically by version 1.26.13 and must be deleted manually. Owners may not know when a key was created, and post-cutoff connections are not revoked by the update. Cleanup guidance may change as researchers identify additional backdoor variants.

TeamUpdraft says customer passwords were stored as hashes, but the source material does not specify the hashing method or report evidence that passwords were accessed or misused. It also does not say whether the attackers accessed other information beyond the database fields listed in the incident notice.

Actions for Connected Site Owners

TeamUpdraft users should install the applicable UpdraftPlus update and check the company’s current incident advisory for instructions on identifying and deleting keys that fall outside the automatic revocation window. The vendor recommends reauthorizing external storage and rotating its access credentials for sites connected through UpdraftCentral. Updating is not evidence that a site is clean.

Owners should inspect connected WordPress sites for unfamiliar plugins and accounts, including accounts with names resembling data-ops or media-staff and the display name “Site Tools.” The reported plugin description, “Small maintenance toolkit: keeps option storage tidy,” is another possible indicator, but researchers say variants differ. If a suspicious plugin or account is found, the site should be treated as compromised and handled using current guidance from TeamUpdraft, Patchstack and Nethemba. Further updates are expected as the company and researchers clarify the scope and cleanup steps.

Key Questions

Does installing UpdraftPlus 1.26.13 remove a backdoor?

No. The update revokes some UpdraftCentral keys, but it does not remove a malicious plugin or attacker-created account already present on a WordPress site.

Which UpdraftPlus versions did TeamUpdraft release?

TeamUpdraft released version 1.26.13 for the free plugin and 2.26.13 for Premium. Site owners should check the vendor’s current advisory for the appropriate update and remediation steps.

Are all exposed UpdraftCentral keys revoked automatically?

Not according to Nethemba’s review. It says version 1.26.13 removes keys created before 12:07 UTC on October 18, 2026, while keys created between then and 21:00 UTC require manual deletion.

Were payment-card details or customer backups exposed?

TeamUpdraft said it did not store card details and that payments are handled by Stripe and PayPal. It also said backups sent to customers’ own storage services were not affected. The company has not disclosed the total number of affected customers or sites.

What should site owners check for?

Check for unfamiliar plugins and accounts, including plugins with the reported description “Small maintenance toolkit: keeps option storage tidy.” Because variants may differ and some may be hidden, follow current guidance from TeamUpdraft and the researchers; do not assume a plugin update alone has cleaned a site.

Source: ThorstenMeyerAI.com