WordPress Site Security: The UpdraftCentral Keys Issue And Its Fix Gap

🔍 Read the full analysis: WordPress Site Security: The UpdraftCentral Keys Issue And Its Fix Gap on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on monitors, keyboards and dev gear

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft confirmed on October 19 that attackers accessed its teamupdraft.com website and may have reached a customer database containing UpdraftCentral Cloud connection keys. Researchers say attackers used stolen keys to install backdoor plugins on WordPress sites, and the company’s update does not remove infections already present.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said attackers accessed its website over the weekend of October 17–18. The company believes they reached a database containing customer names, email and billing addresses, order history, hashed account passwords, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft said payment card details were not stored in the database; Stripe and PayPal handled payments.

TeamUpdraft released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) to revoke exposed keys. The company said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected. It also said it closed the access route, signed out accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated payment-provider keys. The incident was reported to the UK Information Commissioner’s Office.

Security firms Patchstack and Nethemba describe a different risk from a typical plugin flaw: a connected site treats commands signed with a genuine UpdraftCentral key as authorized. Patchstack said the attacker used a command to upload and activate plugins. It counted 99 different plugin names installed between the afternoon of October 18 and 09:23 on October 19. Nethemba said it found the attack on three of its own sites. TeamUpdraft has not published how many customers or WordPress sites were affected.

Why Stolen Keys Could Control Sites

UpdraftCentral is designed to let a site owner manage multiple WordPress installations through a central dashboard. When a site is connected, its key authorizes signed dashboard commands, including plugin installation. Researchers say the commands in this incident were correctly signed, so the sites accepted them without an attacker needing to exploit a software vulnerability. That means fully patched sites could still be affected if they trusted a stolen key.

The incident also creates a separate cleanup problem. Updating the plugin can revoke some credentials, but it does not identify or remove an unauthorized plugin or account that an attacker already created. Researchers describe backdoors that can add accounts with elevated capabilities and establish login sessions that bypass the normal login form. A site where such a backdoor is found should be treated as compromised; simply updating UpdraftPlus is not a complete remediation.

Key exposure may not be obvious to site owners. The source material says the option to add a site to UpdraftCentral is enabled by default when connecting a TeamUpdraft account in UpdraftPlus settings. Nethemba also reported that keys do not expire. Owners may need to check whether a site was connected and when its key was created, rather than assuming that no deliberate dashboard use means no key exists.

How the Key Revocation Changed

TeamUpdraft initially released UpdraftPlus 1.26.12 on October 19, intending to revoke all UpdraftCentral Cloud keys created before the incident. Nethemba said its code review found that the release did not delete any keys because of a bug. Version 1.26.13 followed later that day, with a changelog note saying the revocation in 1.26.12 was properly applied.

Nethemba’s analysis says version 1.26.13 deletes keys created before 12:07 UTC on October 18. It says keys created from 12:07 to 21:00 UTC that day are not removed automatically and need manual deletion. The source material says TeamUpdraft’s stated cutoff was 22:00 British Summer Time, equivalent to 21:00 UTC. The difference between the analysis and the stated cutoff leaves a time window site owners should check against current vendor guidance.

The source also describes this as the second serious incident involving this channel in five months. Nethemba said the attack did not rely on a modified plugin, weak cryptography or the older key-forgery vulnerability CVE-2026-10795, which it says was fixed in June in version 1.26.5. In this case, researchers traced the activity to genuine dashboard keys rather than a new plugin exploit.

“The commands are correctly encrypted and signed with genuine dashboard private keys.”

— Patchstack

Affected Sites and Cleanup Remain Unclear

The number of affected customers and sites is unknown. TeamUpdraft has not provided a count, and the available source material does not establish how many exposed keys were used or how many installations received a backdoor. The precise set of keys requiring manual deletion also needs to be checked against the vendor’s latest instructions, given the cutoff difference described by Nethemba.

Researchers report several backdoor variants. Some may hide from the WordPress plugin list, while an early version can cause HTTP 500 errors before its token check runs. Nethemba and Patchstack warn against repairing that broken plugin, because doing so may activate its backdoor; they advise removing it. The source material says cleanup guidance is changing as variants are identified, so there is no single confirmed cleanup procedure here that covers every affected configuration.

TeamUpdraft said backups stored in customers’ own services, such as Google Drive, Dropbox or Amazon S3, were not affected. However, it recommends re-authorizing storage and rotating access keys if UpdraftCentral was used to access the site. The extent to which individual customers must take those steps depends on their setup and the current vendor guidance.

Check Keys and Site Integrity

Site owners using UpdraftPlus should install the current vendor-recommended version and consult the latest TeamUpdraft advisory alongside the Patchstack and Nethemba analyses. They should check whether UpdraftCentral was connected, determine when keys were created where possible, and follow instructions for manually deleting keys that fall outside automatic revocation.

Owners should also inspect sites for unfamiliar plugins and accounts rather than treating a successful update as proof that a site is clean. If a backdoor or suspicious account is found, the site should be handled as compromised, with remediation guided by current vendor and researcher advice. Where UpdraftCentral provided access to external storage, owners should re-authorize that connection and rotate its credentials as TeamUpdraft recommends.

TeamUpdraft’s public advisory and further researcher findings are the next sources for updated scope and cleanup instructions. The available information does not establish a final count of affected sites or confirm that all exposed keys have been revoked.

Key Questions

What did attackers access?

TeamUpdraft said attackers accessed teamupdraft.com and that the company believes they reached a customer database. It contained personal and account information, including UpdraftCentral connection keys. The company said payment card details were not stored there.

Does updating UpdraftPlus remove a backdoor?

No. The update is intended to revoke exposed keys within its coverage, but it does not remove a backdoor plugin or unauthorized account that has already been installed. Site owners need to check for signs of compromise and follow current cleanup advice.

Which UpdraftPlus versions include the fix?

TeamUpdraft released 1.26.13 for the free plugin and 2.26.13 for Premium. The source material says 1.26.12 did not revoke keys because of a bug, according to Nethemba’s code review.

Are all exposed keys revoked automatically?

Not according to Nethemba’s analysis. It says version 1.26.13 removes keys created before 12:07 UTC on October 18, while some keys created later that day require manual deletion. Check TeamUpdraft’s current advisory for instructions applicable to your account.

Were customer backups or payment cards taken?

TeamUpdraft said payment card data was not stored in the affected database and that backups sent directly to services such as Google Drive, Dropbox or Amazon S3 were not affected. It recommends re-authorizing storage and rotating access keys if UpdraftCentral was used to access a site.

Source: ThorstenMeyerAI.com