Stolen Keys, WordPress Backdoors, And The UpdraftCentral Fix Gap Explained

🔍 Read the full analysis: Stolen Keys, WordPress Backdoors, And The UpdraftCentral Fix Gap Explained on ThorstenMeyerAI.com

TeamUpdraft disclosed a breach on October 19, saying attackers accessed its teamupdraft.com website over the October 17–18 weekend and may have reached a customer database containing UpdraftCentral connection keys. Security researchers say attackers used keys to install backdoor plugins on WordPress sites, including sites running current software. TeamUpdraft has issued updated UpdraftPlus releases, but the fixes do not remove an already-installed backdoor and do not revoke every potentially exposed key.

According to TeamUpdraft’s incident notice, the database may have included customer names, email and billing addresses, order history, hashed account passwords, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said payment card data was not stored in the affected database because payments are handled by Stripe and PayPal. It also said backups stored by customers with services such as Google Drive, Dropbox or Amazon S3 were not affected.

UpdraftCentral Cloud lets customers manage multiple WordPress sites through a hosted dashboard. The UpdraftPlus plugin includes a client for that service; once a site is connected with a key, it can accept commands signed with the key. Patchstack reported that attackers used the command plugin.upload_plugin to upload and activate plugins. Because the commands were signed with genuine dashboard keys, researchers said the attack did not require exploiting a software vulnerability in UpdraftPlus. Sites running the latest version could still be affected if they had an exposed connection.

TeamUpdraft released UpdraftPlus 1.26.13 and 2.26.13 Premium after an earlier release, version 1.26.12, did not revoke keys as intended, according to Nethemba’s code review. Nethemba says version 1.26.13 deletes keys created before 12:07 UTC on October 18, but leaves keys created from 12:07 to 21:00 UTC that day. Those keys require manual removal, according to the researchers. The vendor’s stated cutoff is 22:00 British Summer Time, equivalent to 21:00 UTC.

Why Stolen Keys Bypassed Patching

The incident highlights a risk distinct from an unpatched software flaw: valid credentials can authorize harmful actions through an otherwise functioning product. If a WordPress site trusted a stolen key, its normal command checks could accept an attacker’s request. Updating the plugin alone cannot reverse commands already carried out or prove that a site is clean.

Patchstack counted 99 different plugin names installed between the afternoon of October 18 and 09:23 on October 19. It said “Site Health Cache” appeared often and identified the description “Small maintenance toolkit: keeps option storage tidy” as a useful marker. The figure is a count of plugin names observed in that period, not a count of affected sites or customers; TeamUpdraft has not disclosed how many accounts or installations were affected.

Researchers described backdoors that can create an attacker-controlled account, assign it elevated capabilities, and use a persistent cookie to log in without the ordinary login form. Some variants may hide from the plugin list. Nethemba and Patchstack warn that removing the plugin alone may leave the created account behind, while trying to repair an early variant that triggers HTTP 500 errors could activate its malicious behavior.

How UpdraftCentral Keys Work

UpdraftCentral is a remote management service connected to WordPress sites through keys. The source report says the connection option is selected by default when a TeamUpdraft account is linked in UpdraftPlus settings; Nethemba reported the same behavior in the Premium version. The report also says these keys do not expire, and Nethemba observed keys created in November 2025 being used after the breach.

Nethemba said it found the attack on three of its own sites and attributed the activity to keys leaked from the UpdraftCentral Cloud environment. It said its analysis ruled out a modified plugin, weak cryptography and the older forgery issue CVE-2026-10795, which was fixed in UpdraftPlus 1.26.5 in June. The source material describes this as a second serious incident involving this channel in five months, but does not provide further detail about the earlier incident.

TeamUpdraft said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected. It also said it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. The company reported the incident to the UK Information Commissioner’s Office.

„The commands are correctly encrypted and signed with genuine dashboard private keys.“

— Patchstack

Affected Sites and Keys Still Unclear

The number of affected customers and WordPress sites is unknown. TeamUpdraft has not published a count, and the reported tally of 99 plugin names is not an estimate of affected installations. The company’s investigation and researchers’ cleanup guidance are still developing as additional backdoor variants are identified.

It is also unclear which individual customers had exposed keys, when those keys were created, and whether every malicious plugin variant has been identified. The source material says keys created during part of October 18 are not removed by the update and must be deleted manually. Connections created after the revocation cutoff are not removed by that process. A site may therefore need investigation even after its plugin is updated.

Follow Updates and Check Each Site

TeamUpdraft’s advisory and the analyses from Patchstack and Nethemba are the cited sources for evolving remediation instructions. Site owners should update to the applicable UpdraftPlus release, check whether an UpdraftCentral connection was enabled, and follow current guidance on identifying and removing malicious plugins, unauthorized accounts and exposed keys. The update should not be treated as a cleanup tool for a backdoor already installed.

TeamUpdraft’s notice says customers who used UpdraftCentral to access a site should re-authorize connected storage and rotate its access keys. Where a backdoor is found, the researchers’ warnings indicate that removing the plugin alone may not be sufficient. Further information on the scale of the breach, the investigation and any changes to cleanup advice has not been provided in the source material.

Key Questions

What was breached?

TeamUpdraft said attackers accessed its teamupdraft.com website over the October 17–18 weekend and may have reached a customer database containing personal and account information, including UpdraftCentral connection keys. The company said payment card details were not stored there.

Does updating UpdraftPlus remove a backdoor?

No. The releases address key revocation, but they do not remove a backdoor or an attacker-created account already present on a WordPress site. Sites need separate inspection and cleanup based on current vendor and researcher guidance.

Which versions contain the reported fix?

TeamUpdraft released UpdraftPlus 1.26.13 and Premium 2.26.13. Nethemba reported that version 1.26.12 had failed to delete keys as intended and that 1.26.13 revokes keys created before 12:07 UTC on October 18.

Were backups stored with Google Drive or Amazon S3 affected?

TeamUpdraft said backups customers stored with services such as Google Drive, Dropbox and Amazon S3 were not affected. It recommends re-authorizing that storage and rotating access keys if UpdraftCentral was used to access the site.

How many sites were compromised?

No confirmed total has been published. TeamUpdraft has not said how many customers or sites were affected. Patchstack’s count of 99 refers to different plugin names observed in a specified period, not the number of infected sites.

Source: ThorstenMeyerAI.com