Stolen Keys And A Patch Gap: The UpdraftCentral Issue Affecting WordPress

🔍 Read the full analysis: Stolen Keys And A Patch Gap: The UpdraftCentral Issue Affecting WordPress on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft disclosed on October 19 that attackers accessed its website over the weekend of October 17–18 and likely reached a customer database containing UpdraftCentral Cloud connection keys. Security researchers say attackers used the keys to install backdoor plugins on WordPress sites, including sites running current software; TeamUpdraft has released an UpdraftPlus update, but that update does not remove backdoors already installed.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said the accessed database held customer names, email addresses, billing addresses and order history, along with password hashes, two-factor authentication settings, and keys associated with UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment-card data; Stripe and PayPal process payments. It also said backups stored by customers with services such as Google Drive, Dropbox or Amazon S3 were not affected.

Researchers at Patchstack analysed the attack and reported that stolen UpdraftCentral keys were used to send a command to upload and activate a plugin. The command was signed with genuine dashboard keys, so the client accepted it as authorised. No software vulnerability was required, according to Patchstack, and sites with the latest UpdraftPlus version could still be affected if they had an exposed key.

TeamUpdraft released UpdraftPlus versions 1.26.13 (free) and 2.26.13 (Premium) to revoke some keys. The release followed version 1.26.12, which Nethemba said failed to delete keys because of a bug. Nethemba’s review says version 1.26.13 deletes keys created before 12:07 UTC on October 18, but does not remove keys created between 12:07 and 21:00 UTC that day. Those keys require manual deletion, according to the analysis. Updating also does not remove an installed backdoor or the account it created.

Why Stolen Control Keys Matter

UpdraftCentral keys can authorise remote commands on connected WordPress sites. A breach of the service holding those keys can therefore create a route to alter sites without exploiting a flaw in the sites’ own software. That changes the practical response: applying a plugin update alone cannot establish that a site is clean.

Patchstack counted 99 plugin names used in installations between the afternoon of October 18 and 09:23 on October 19. That is a count of names observed during that period, not a count of affected sites or customers. The company and researchers have not published a confirmed total of compromised sites. The incident matters to administrators because the attack can leave behind a privileged account and persistent access even after the malicious plugin is removed.

TeamUpdraft recommends re-authorising storage and rotating access keys if UpdraftCentral was used to access a site. This is especially relevant for sites connected to external storage: the stored backups themselves were not reported affected, but credentials used to reach services may need review if they were managed through the compromised connection.

How UpdraftCentral Connections Work

UpdraftPlus includes an UpdraftCentral client that remains inactive until a site receives a connection key. Once connected, the site accepts commands properly signed by the corresponding dashboard key, with the permissions of the user who created that key. The source material says the option to add a site to UpdraftCentral is ticked by default when a TeamUpdraft account is connected in UpdraftPlus settings. Nethemba reported the same default behaviour in the Premium version.

Nethemba said it found the attack on three of its own sites and traced the commands to an attacker-controlled server using leaked keys. It ruled out a modified plugin, weak cryptography and the older key-forgery issue CVE-2026-10795, which it said was fixed in June in UpdraftPlus 1.26.5. The report describes this as a second serious incident involving this channel within five months, though the supplied material does not detail the earlier incident.

Researchers identified a recurring plugin-description string, “Small maintenance toolkit: keeps option storage tidy,” as a useful indicator. Reported plugin names included “Site Health Cache,” “Seo Helper,” “Wp Forge” and “Js Clean.” Some variants may hide themselves from the plugin list. Researchers also warned that an early variant caused HTTP 500 errors before checking its activation token; they advise removing such a suspicious plugin rather than repairing it, because changing it may allow the backdoor to run.

““Properly apply the revocation in 1.26.12.””

— TeamUpdraft

How Many Sites Were Reached

The number of affected customers and WordPress sites is not yet known. TeamUpdraft has not published a count, and the 99 plugin names reported by Patchstack do not establish how many sites received them. It is also not clear from the supplied material how many customers had UpdraftCentral connections enabled or whether all exposed keys were used.

The precise scope of the database access remains under investigation. TeamUpdraft said it believes attackers reached the customer database, but the source does not establish that every listed record was accessed or misused. Researchers’ key-revocation findings also describe a gap between the cutoff in the vendor’s response and the keys removed by version 1.26.13. Site owners may need current guidance from TeamUpdraft, Patchstack and Nethemba as cleanup advice develops and additional backdoor variants are identified.

Checks for Connected Site Owners

TeamUpdraft said it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys, rotated keys with payment providers and reported the incident to the UK Information Commissioner’s Office. The company’s advisory and researchers’ analyses remain the cited sources for updated response guidance.

Administrators should update UpdraftPlus to the relevant patched version, then separately inspect connected sites for suspicious plugins, unexpected administrator or editor accounts, and signs of persistent access. A site where a backdoor is found should be treated as compromised; removing the plugin alone may leave its account behind. Owners using UpdraftCentral should also review the creation dates of their connection keys and follow the latest instructions for keys that fall outside the automated revocation period.

Further details are still needed on the total number of affected sites, the full extent of database access and the status of keys created during the uncovered window. Until those are clarified, the update should be treated as one part of incident response—not proof that a connected site is safe.

Key Questions

Does installing UpdraftPlus 1.26.13 remove a backdoor?

No. The update revokes some exposed UpdraftCentral keys, but it does not remove a backdoor plugin or an account already created on a site. Those require separate investigation and cleanup.

Were UpdraftPlus backups or payment-card details exposed?

TeamUpdraft said customer backups stored with services such as Google Drive, Dropbox or Amazon S3 were not affected, and that it did not store card data. Stripe and PayPal handle payments. The company did report that the database contained customer contact, billing and order information, password hashes, two-factor settings and service keys.

Can a fully updated WordPress site still be affected?

Yes, according to Patchstack. The reported attack used legitimate UpdraftCentral keys to send authorised commands, so it did not depend on an unpatched software vulnerability.

What should site owners check first?

Update UpdraftPlus, then inspect the site for unfamiliar plugins and unexpected accounts, including accounts with elevated capabilities. If UpdraftCentral was used, review connection keys and follow current TeamUpdraft and researcher guidance; an update alone does not confirm that a site is clean.

Source: ThorstenMeyerAI.com