How To Assess WordPress Exposure To Stolen UpdraftCentral Keys

🔍 Read the full analysis: How To Assess WordPress Exposure To Stolen UpdraftCentral Keys on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get everyday essentials delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft said on October 19, 2026, that attackers accessed its teamupdraft.com website over the previous weekend and may have reached a customer database containing UpdraftCentral connection keys. Security firms Patchstack and Nethemba reported that attackers used stolen keys to send commands that installed backdoor plugins on WordPress sites, meaning an updated plugin alone may not remove an existing compromise.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said the database included customer names, email addresses, billing addresses, order histories, hashed account passwords, two-factor authentication settings and keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment card data; Stripe and PayPal process payments. It also said backups sent to customers’ own storage services, such as Google Drive, Dropbox or Amazon S3, were not affected.

TeamUpdraft released UpdraftPlus 1.26.13 for free users and 2.26.13 for Premium users to address revocation of exposed keys. The company said it closed the access route, signed users out, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It reported the breach to the UK Information Commissioner’s Office. These steps do not remove a malicious plugin or account already installed on a WordPress site.

Patchstack said it observed attackers issuing the command plugin.upload_plugin, which uploads and activates a plugin. It counted 99 different plugin names used between the afternoon of October 18 and 09:23 on October 19. Nethemba reported finding the attack on three of its own sites and said the keys appeared to have been used from an attacker-controlled server. Both researchers said the commands were authenticated with genuine dashboard keys; they did not require exploiting a vulnerability in the current UpdraftPlus plugin.

Why Key Exposure Reaches Live Sites

UpdraftCentral Cloud lets site owners manage multiple WordPress installations through a hosted dashboard. A connected site accepts commands authenticated with its connection key, and those commands can carry the permissions of the user who created the key. The breach therefore created a route from exposed dashboard credentials to actions on connected websites, including plugin installation.

That distinction changes the response: patching closes or limits the exposed key route, but it does not establish that a site is clean. Researchers described backdoors that can create an administrator-like account, hide from the plugin list or use a persistent login cookie. A site owner who only updates UpdraftPlus could leave an attacker’s access in place.

The exposure may also affect owners who do not recall enabling remote management. The source material says the UpdraftCentral connection option is selected by default when a TeamUpdraft account is connected in UpdraftPlus settings; Nethemba reported similar behavior in Premium. Researchers also said keys did not expire, so older connections could remain relevant. These details make checking each site and its account history more useful than relying on memory of recent setup changes.

How the UpdraftCentral Connection Works

UpdraftPlus is a WordPress backup plugin, while UpdraftCentral Cloud provides remote management of connected sites. According to the source material, the UpdraftCentral client is included in UpdraftPlus and remains dormant until a connection key is supplied. A valid signed command can then request actions such as installing a plugin.

Nethemba said it ruled out a modified plugin, weak cryptography and an older command-forgery vulnerability, CVE-2026-10795, which it said was fixed in version 1.26.5 in June. Its analysis attributed the reported activity to leaked dashboard keys rather than a new software flaw. That account is the researchers’ assessment; the complete scope and technical findings of TeamUpdraft’s investigation have not been published in the supplied material.

The response also changed after an initial release. TeamUpdraft issued version 1.26.12 on October 19, intending to revoke keys created before the incident. Nethemba said a bug meant that release deleted no keys. Version 1.26.13 followed later that day. Nethemba said it deletes keys created before 12:07 UTC on October 18, but reported that keys created from 12:07 to 21:00 UTC that day require manual deletion. The source material says TeamUpdraft gave a 22:00 BST cutoff, equivalent to 21:00 UTC.

“The commands are correctly encrypted and signed with genuine dashboard private keys.”

— Patchstack

Scope and Cleanup Still Developing

TeamUpdraft has not said how many customers or WordPress sites were affected. The company’s investigation may add detail about how attackers accessed the website, how many records were reached and whether all exposed keys were used. Researchers’ reports describe observed activity, not a complete inventory of compromised installations.

The source material says UpdraftPlus revocation does not remove backdoors, and that keys created after the stated cutoff remain active by design. It also reports a gap between the cutoff Nethemba observed in version 1.26.13 and the cutoff TeamUpdraft stated. Site owners may need to establish when a key was created and follow updated vendor and researcher guidance. Some reported backdoor variants can cause HTTP 500 errors before checking their activation token; Nethemba and Patchstack warn against repairing such a plugin, as doing so could allow the backdoor to run.

The precise indicators and cleanup recommendations may change as additional variants are examined. The source material does not establish whether every suspicious plugin or account observed in the reports is linked to the same attacker, nor does it provide a final incident report from TeamUpdraft.

Check Keys and Site Access

Site owners who use UpdraftPlus should install the appropriate current release and consult TeamUpdraft’s latest incident advisory alongside Patchstack’s and Nethemba’s analyses. They should check whether UpdraftCentral was connected, review connection keys and their creation dates, and manually remove keys that the update does not revoke, following current vendor instructions.

Owners should also inspect plugin files and accounts for the indicators described by researchers, including the reported plugin description, unfamiliar users with names such as “Site Tools,” and accounts with unexpected capabilities. If a backdoor is found, updating UpdraftPlus alone is not a cleanup. Because researchers describe persistent access and multiple variants, affected site owners should treat the installation as compromised and follow incident-response guidance rather than simply removing a visible plugin. Anyone whose site was managed through UpdraftCentral should re-authorize connected storage and rotate its access keys, as TeamUpdraft recommends.

Further updates are expected as TeamUpdraft continues its investigation and security firms refine detection and cleanup advice. The company has not yet published the number of affected customers or sites in the material provided.

Key Questions

Does updating UpdraftPlus remove a backdoor?

No. The update addresses key revocation, but the reported malicious plugin and any account it created may remain on the site. Researchers advise checking the installation separately and following current cleanup guidance.

Which versions did TeamUpdraft release to address the keys?

TeamUpdraft released UpdraftPlus 1.26.13 for the free plugin and 2.26.13 for Premium. Nethemba reported that version 1.26.12 did not revoke keys because of a bug.

Were payment cards or customer backups exposed?

TeamUpdraft said it did not store payment card data, which is handled by Stripe and PayPal. It also said backups stored in customers’ own services, such as Google Drive, Dropbox or Amazon S3, were not affected. For storage connected through UpdraftCentral, the company recommends re-authorizing it and rotating access keys.

How many sites were affected?

TeamUpdraft has not disclosed the number of affected customers or sites in the source material. Patchstack and Nethemba reported observations from their analyses, but those do not establish the full scale of the incident.

What should an owner do if a suspicious plugin causes errors?

Nethemba and Patchstack warn against repairing a reported backdoor that causes HTTP 500 errors, because the change could activate it. Follow current incident-response advice and treat a confirmed backdoor as a site compromise, rather than relying on a plugin update alone.

Source: ThorstenMeyerAI.com