Stolen UpdraftCentral Keys: What WordPress Owners Need To Review

🔍 Read the full analysis: Stolen UpdraftCentral Keys: What WordPress Owners Need To Review on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft said on October 19, 2026, that attackers had accessed its website and likely reached a customer database containing UpdraftCentral Cloud connection keys. Security researchers reported that stolen keys were used to install backdoor plugins on connected WordPress sites, including sites running current software versions, so updating UpdraftPlus alone may not remove an existing compromise.

In its incident post, TeamUpdraft said the access occurred over the weekend of October 17 and 18, and that the database may have included customer names, email and billing addresses, order histories, hashed passwords, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment card data; Stripe and PayPal process payments. It also said backups stored with customers’ own providers, such as Google Drive, Dropbox or Amazon S3, were not affected.

TeamUpdraft released UpdraftPlus 1.26.13 and 2.26.13 Premium to revoke affected keys. The company said it closed the access route, signed out accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It reported the incident to the UK Information Commissioner’s Office. The company has not disclosed how many customers or WordPress sites may be affected.

Patchstack said its analysis found attackers issuing a command to upload and activate plugins. Because the command was signed with genuine dashboard keys, the request passed the plugin’s checks; researchers said no software vulnerability was required. Patchstack counted 99 plugin names used in installations from October 18 through 09:23 on October 19. One recurring description was “Small maintenance toolkit: keeps option storage tidy.”

Why Stolen Keys Could Install Backdoors

UpdraftCentral keys give a connected dashboard authority to send commands to a WordPress site. According to Patchstack, the attacker used that legitimate command channel to upload and activate plugins, meaning a site could be affected without an exploitable flaw in its installed software. Running the latest version does not, by itself, show that a site was untouched.

The reported backdoor behavior makes removal more involved than deleting an unfamiliar plugin. Researchers said some variants created accounts with elevated capabilities and persistent login cookies; the account could remain after the plugin was removed, and some variants hid from the plugin list. A site where a backdoor is found should be treated as compromised while its files, users and access credentials are reviewed.

Some site owners may not realize they created a connection. TeamUpdraft’s account-linking option to add a site to UpdraftCentral is ticked by default, according to the source material; Nethemba reported similar behavior in the Premium version. Nethemba also said it observed keys created in November 2025 being used after the breach, underscoring the potential relevance of older, non-expiring keys.

How the Key Exposure Unfolded

UpdraftPlus is a WordPress backup plugin that includes a client for connecting a site to UpdraftCentral. The client remains inactive until a connection key is provided. Once connected, the site accepts commands signed with that key, with the permissions of the user who created it. That design allows remote site management, but it also means a stolen valid key can be used as an authorized control credential.

TeamUpdraft’s first release, version 1.26.12 on October 19, was intended to revoke keys created before the incident. Nethemba reported that a bug meant the release deleted no keys. Version 1.26.13 followed that evening. Nethemba’s code review said the newer version deletes keys created before 12:07 UTC on October 18, while keys created between 12:07 and 21:00 UTC on that day are not removed automatically and must be deleted manually. The source material says TeamUpdraft’s stated cutoff was 22:00 BST, equivalent to 21:00 UTC.

TeamUpdraft said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected. Nethemba said it found the attack on three of its own sites and attributed the exposed keys to the UpdraftCentral Cloud environment. It said its investigation ruled out a modified plugin, weak cryptography and the older forgery issue CVE-2026-10795, fixed in version 1.26.5 in June. These are researchers’ findings, distinct from the company’s account of the breach.

““Properly apply the revocation in 1.26.12.””

— TeamUpdraft

Affected Sites and Key Cutoffs

The number of affected customers and sites is not yet known. TeamUpdraft said it believes attackers reached the customer database, but the source material does not provide a confirmed total for records accessed or sites targeted. Researchers reported malicious installations, but their observed counts do not establish the full scope.

Owners may also face uncertainty about whether a particular key was created before or after the revocation cutoff. Nethemba’s account of the version 1.26.13 behavior identifies a window of keys that require manual deletion, while post-cutoff connections are left in place. The precise cleanup steps may change as researchers identify variants; the source material advises checking current vendor and researcher guidance.

It is also not clear from the available information how long attackers had access, whether every exposed credential was used, or whether the incident involved other data beyond the fields TeamUpdraft listed. The company’s investigation and its assessment of the breach remain ongoing.

Checks for Connected WordPress Sites

WordPress owners using UpdraftPlus should install the applicable 1.26.13 release and review TeamUpdraft’s current advisory for key revocation instructions. Those who connected sites to UpdraftCentral should check whether keys remain, including keys from the October 18 cutoff window that Nethemba says need manual removal. If the connection was used to access a site’s storage, TeamUpdraft recommends re-authorizing that storage and rotating its access keys.

Owners should also inspect plugin lists and administrator-level users for unfamiliar entries, paying attention to the plugin description and account patterns described by Patchstack and Nethemba. If a suspicious plugin is found, researchers warn against simply repairing an error in a broken variant: removing the plugin is advised, but that does not remove any account it created. Treat a site with evidence of a backdoor as compromised and follow updated incident-response guidance from the vendor and researchers.

TeamUpdraft’s investigation, site-impact assessment and cleanup advice remain developing. Further company notices or researcher updates may clarify the number of affected sites and the steps needed for keys or backdoor variants not covered by the current guidance.

Key Questions

Does updating UpdraftPlus remove a backdoor?

No. The update revokes certain connection keys, but TeamUpdraft and researchers warn that it does not remove a backdoor plugin or an account already created on a site.

Which UpdraftPlus versions were released to revoke keys?

TeamUpdraft released version 1.26.13 and version 2.26.13 Premium. Nethemba reported that version 1.26.12 did not delete keys as intended.

Were backups in Google Drive, Dropbox or Amazon S3 exposed?

TeamUpdraft said backups stored with customers’ own providers were not affected. It recommends re-authorizing that storage and rotating access keys if UpdraftCentral was used to access the site.

How can an owner tell whether a site has a backdoor?

Researchers described suspicious plugin names and a recurring description, along with unfamiliar accounts that may have elevated capabilities. These are indicators to investigate, not a complete detection method; owners should consult the latest TeamUpdraft, Patchstack and Nethemba guidance.

How many sites were affected?

The total has not been disclosed. Patchstack counted 99 plugin names in observed installations during a specified period, but that count is not a confirmed total of affected sites.

Source: ThorstenMeyerAI.com