How Stolen Keys Can Open A Backdoor Into WordPress Sites Via UpdraftCentral

🔍 Read the full analysis: How Stolen Keys Can Open A Backdoor Into WordPress Sites Via UpdraftCentral on ThorstenMeyerAI.com

TeamUpdraft said on October 19, 2026, that attackers accessed its teamupdraft.com website and may have reached a customer database containing UpdraftCentral Cloud connection keys; researchers say those keys were used to install backdoor plugins on WordPress sites. The company released UpdraftPlus updates to revoke some affected keys, but updating alone does not remove an installed backdoor.

According to TeamUpdraft’s incident notice, the accessed database held customer names, email and billing addresses, order history, hashed account passwords, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft said it did not store payment-card data, which is handled by Stripe and PayPal. It also said backups held in customers’ own storage services, such as Google Drive, Dropbox or Amazon S3, were not affected.

Security firms Patchstack and Nethemba reported that attackers used genuine UpdraftCentral keys to send commands to connected WordPress sites. Patchstack said it observed the command plugin.upload_plugin, which uploads and activates a plugin. Because the commands were signed with valid keys, the affected sites did not need to have an unpatched software flaw; researchers said fully updated sites could also be affected.

Patchstack counted 99 plugin names installed during the activity it examined, between the afternoon of October 18 and 09:23 on October 19. Names included “Site Health Cache,” “Seo Helper,” “Wp Forge” and “Js Clean.” Researchers identified the description “Small maintenance toolkit: keeps option storage tidy” as a useful indicator, but warned that names and behavior vary. Some versions reportedly create an unauthorized account and can hide from the plugin list.

Why Valid Keys Bypassed Updates

The incident shows how legitimate remote-management credentials can become a route to site compromise when they are exposed. UpdraftPlus includes an UpdraftCentral client that can remain inactive until a connection key is supplied. Once connected, it accepts properly signed commands with the permissions associated with the key. In this case, researchers said the attacker did not need to exploit a flaw in the plugin: the commands passed its normal signature checks.

That makes the remediation more involved than installing a security update. A key revocation can prevent some future commands, but it cannot undo a plugin already installed or remove an account that the plugin created. Site owners who used UpdraftCentral may need to inspect their sites, remove suspicious components and accounts, and review connected storage credentials. TeamUpdraft also recommends re-authorizing storage connections for sites managed through UpdraftCentral.

The potential reach is hard to quantify. TeamUpdraft has not said how many customers or websites were affected, and the key database’s exposure does not by itself establish that every listed account or site was targeted. However, the reported ability to issue remote commands means site owners should treat a detected backdoor as a sign that the site may have been compromised, not as an isolated plugin problem.

The Breach and Key Revocation

TeamUpdraft said attackers accessed its website over the weekend of October 17 and 18 and that the company believes they reached its customer database. It said it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also reported the incident to the UK Information Commissioner’s Office. The company said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected.

TeamUpdraft first released UpdraftPlus 1.26.12 on October 19, intending to revoke UpdraftCentral Cloud keys created before the incident. Nethemba reported that a bug meant the release did not delete any keys. Version 1.26.13 for the free plugin and 2.26.13 for Premium followed, with a changelog saying the revocation was properly applied. Nethemba’s review said the corrected code removes keys created before 12:07 UTC on October 18.

Nethemba said keys created between 12:07 and 21:00 UTC on October 18 were not removed by that update and would need manual deletion. The firm also said it found keys created as early as November 2025 being used after the breach, consistent with keys that do not expire. It reported finding the attack on three of its own sites and said its analysis pointed to keys taken from the UpdraftCentral Cloud environment, rather than a modified plugin, weak cryptography or the older vulnerability CVE-2026-10795, which was fixed in June.

“The commands are correctly encrypted and signed with genuine dashboard private keys.”

— Patchstack

Affected Sites and Cleanup Scope

TeamUpdraft has not disclosed how many customers, keys or WordPress sites were affected, or how many were targeted successfully. It has not published a full account of how attackers entered the website or how long they had access. The company’s belief that the customer database was reached is not the same as a public accounting of which records were taken.

The exact set of keys requiring manual action may also depend on when a connection was created. Nethemba identified a gap between its reported revocation cutoff of 12:07 UTC and TeamUpdraft’s stated cutoff of 21:00 UTC on October 18. The supplied incident information does not resolve that difference or establish how every customer can identify the creation time of each key. Researchers have also reported multiple backdoor variants, so no single plugin name should be treated as a complete detection list.

TeamUpdraft’s statement that UpdraftPlus downloads and self-hosted UpdraftCentral were unaffected addresses those products, but does not establish that a connected site is clean. Researchers warn that removing the malicious plugin may leave an unauthorized account behind. Cleanup instructions may change as analysis continues.

Check Keys, Plugins and Accounts

TeamUpdraft users should follow the latest company advisory and current guidance from Patchstack and Nethemba. Site owners who used UpdraftCentral should confirm that they are running the relevant corrected UpdraftPlus version, determine whether any connection keys fall outside the automated revocation window, and manually remove keys when instructed. Those who connected their own storage through UpdraftCentral should re-authorize it and rotate access keys, as TeamUpdraft recommends.

Owners should also inspect plugin files and the WordPress user list for unfamiliar plugins, administrator-level capabilities or accounts that do not belong. A plugin displaying an error should not be repaired simply to restore the site before investigation: Nethemba and Patchstack warned that one early variant crashed requests before its token check, and fixing the error could activate its backdoor behavior. If evidence of a backdoor is found, the site should be treated as compromised and handled through a careful cleanup and recovery process; updating UpdraftPlus is only one part of that response.

TeamUpdraft’s incident response and researchers’ technical analyses may provide further detail on the number of affected sites, the key cutoff and recommended cleanup. Until those questions are addressed, customers should not assume that a successful plugin update confirms their site is free of unauthorized access.

Key Questions

Does updating UpdraftPlus remove an installed backdoor?

No. The updates are intended to revoke affected connection keys, but they do not remove a backdoor plugin or account that may already have been created. Affected sites require separate inspection and cleanup.

Which UpdraftPlus versions contain the corrected revocation?

TeamUpdraft released UpdraftPlus 1.26.13 and UpdraftPlus Premium 2.26.13 after version 1.26.12 failed to apply the intended revocation, according to Nethemba’s review and the release changelog.

Were customer payment details or backups exposed?

TeamUpdraft said the accessed database did not contain card data because Stripe and PayPal process payments. It also said backups stored in customers’ own services, including Google Drive, Dropbox and Amazon S3, were not affected. The company’s notice listed personal and account data, including hashed passwords and connection keys.

How can a site owner check for a backdoor?

Review the site’s installed plugins and user accounts for unfamiliar entries, and compare them with the current indicators published by TeamUpdraft, Patchstack and Nethemba. Plugin names can vary, so a name alone is not a reliable test. If a suspicious plugin or account is found, treat the site as potentially compromised and follow current incident-response guidance.

How many sites were affected?

The number has not been disclosed. Patchstack counted 99 different plugin names installed during the activity it examined, but that is not a count of affected sites. TeamUpdraft has not published a total for customers or websites affected.

Source: ThorstenMeyerAI.com