How The UpdraftCentral Key Theft Issue Connects To WordPress Backdoors

🔍 Read the full analysis: How The UpdraftCentral Key Theft Issue Connects To WordPress Backdoors on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft disclosed on October 19 that attackers accessed its teamupdraft.com website over the weekend of October 17 and 18 and likely reached a customer database containing UpdraftCentral Cloud connection keys. Researchers say attackers used genuine stolen keys to send commands that installed backdoor plugins on WordPress sites, including sites running current software versions.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said the database contained customer names, email and billing addresses, order history, hashed account passwords, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment card data because Stripe and PayPal process payments. It also said backups sent to customers’ own storage services, such as Google Drive, Dropbox or Amazon S3, were not affected.

Security firm Patchstack analyzed the attack and reported that attackers used the command plugin.upload_plugin to upload and activate plugins. Patchstack said the commands were signed with genuine dashboard keys, so the client accepted them as authorized. This was not, according to the researchers, an exploit of an unpatched software flaw: a site connected to the cloud dashboard could accept a valid command signed with its key.

Patchstack counted 99 plugin names used between the afternoon of October 18 and 09:23 on October 19. Names included “Site Health Cache,” “Seo Helper,” “Wp Forge” and “Js Clean.” Researchers identify a recurring plugin description, “Small maintenance toolkit: keeps option storage tidy,” as a useful indicator. The installed backdoor can create an administrator-capable account, though it is typically assigned the Editor role alongside extra permissions, and can preserve attacker access with a login cookie. Removing the plugin alone may not remove the account.

Stolen Keys Bypassed Site Patches

The incident matters because the attackers appear to have used legitimate management credentials, rather than relying on a vulnerability that site owners could address simply by applying a software patch. UpdraftPlus includes a client for UpdraftCentral; when a site is connected and holds a key, the dashboard can send commands with the permissions associated with that connection. Researchers say sites running the latest plugin version were affected if their keys had been exposed.

TeamUpdraft released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) to apply key revocation. Updating is a necessary containment step, but it does not prove a site is clean. A backdoor and any account it created can remain after the key is revoked or the plugin is removed. Site owners may also need to re-authorize storage connections and rotate related access credentials, as TeamUpdraft recommends for users who connected sites through UpdraftCentral.

How the Cloud Connection Worked

UpdraftCentral Cloud is a hosted dashboard for managing multiple WordPress sites. According to TeamUpdraft, the UpdraftPlus client stays dormant until a site receives a connection key. Once connected, the site can accept commands signed with that key. TeamUpdraft said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected; the reported exposure concerns cloud customer data and keys.

The default setup may have connected sites without some users realizing it: when linking a TeamUpdraft account in UpdraftPlus settings, the option to add the site to UpdraftCentral is selected by default, according to the source material. Nethemba, a security firm that reported finding the attack on three of its own sites, said it found keys created in November 2025 being used after the breach. It attributed the exposure to keys leaked from the UpdraftCentral Cloud environment and said it ruled out a modified plugin, weak cryptography and the older forgery bug CVE-2026-10795, fixed in version 1.26.5 in June.

TeamUpdraft first issued version 1.26.12 on October 19, intending to revoke pre-incident cloud keys. Nethemba said a bug meant that version did not delete keys. Version 1.26.13 followed later that day. Nethemba said the corrected release removes keys created before 12:07 UTC on October 18; it reported that keys created from 12:07 to 21:00 UTC that day are not removed automatically and require manual deletion. The vendor’s stated cutoff, as reported in the source, was 22:00 British Summer Time, equivalent to 21:00 UTC.

“The commands are correctly encrypted and signed with genuine dashboard private keys.”

— Patchstack

Affected Accounts Still Uncounted

TeamUpdraft has not disclosed how many customers, keys or WordPress sites were affected, or how attackers first gained access to the company website. The company said it believes attackers reached the customer database, while researchers report observing compromised sites and analyzing backdoor variants. The full scale of the incident is not established in the available material.

Key revocation also has limits. According to Nethemba, some keys created within the reported October 18 time window require manual deletion, while connections created after the cutoff are not covered by the revocation. The source material does not specify a complete, fixed procedure that applies to every variant or confirm that all affected sites have been identified. Researchers warn that some backdoor versions hide from the plugin list, and one early version can cause HTTP 500 errors before its activation check runs.

Site Checks and Key Rotation

TeamUpdraft said it closed the access route, signed users out, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also said it reported the breach to the UK Information Commissioner’s Office. The company’s advice and researchers’ findings may change as investigation continues, so site owners should consult current notices from TeamUpdraft, Patchstack and Nethemba.

For site owners, the immediate steps described in the source are to install the applicable UpdraftPlus update, check whether a site was connected to UpdraftCentral, and review for unexpected plugins and user accounts. A discovered backdoor should be treated as evidence of compromise: revoking a key or deleting the plugin does not necessarily remove persistent accounts or other changes. Users should follow current incident-response guidance, remove suspicious components and accounts, and rotate credentials for connected services where advised. TeamUpdraft has not provided a public count of affected sites or a stated date for completing its investigation.

Key Questions

What was stolen in the TeamUpdraft breach?

TeamUpdraft said attackers likely reached a customer database containing personal and account information, hashed passwords, two-factor settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. It said payment card data was not stored there.

Does updating UpdraftPlus remove a backdoor?

No. Versions 1.26.13 and 2.26.13 address key revocation, but the source material says an installed backdoor and accounts it created can remain after an update. Sites need separate checks and cleanup.

Were fully patched WordPress sites affected?

Patchstack said attackers used valid stolen dashboard keys to issue commands, so sites on current plugin versions could still be affected if connected keys were exposed. Researchers did not attribute this attack to an unpatched UpdraftPlus flaw.

How can site owners recognize the reported backdoor?

Researchers cite suspicious plugins with names such as “Site Health Cache” and the description “Small maintenance toolkit: keeps option storage tidy,” along with unexpected accounts. Some variants may hide from the plugin list, so those indicators are not an exhaustive check.

How many sites were affected?

TeamUpdraft has not disclosed a number of affected customers or sites. Patchstack counted 99 plugin names in its analysis, but that is not a count of confirmed affected sites.

Source: ThorstenMeyerAI.com