What Makes Stolen UpdraftCentral Keys A Concern For WordPress Sites?

🔍 Read the full analysis: What Makes Stolen UpdraftCentral Keys A Concern For WordPress Sites? on ThorstenMeyerAI.com

Age 18–24?Offer from Amazon

Prime made for students and young adults

• Fast, free delivery for dorm and study essentials
• Prime Video and Amazon Music included
• Member-only deals

Try Prime for Young Adults →Free trial for eligible 18–24 year olds

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft said on October 19, 2026, that attackers who accessed its website likely reached a customer database containing UpdraftCentral Cloud connection keys, and security researchers report those keys were used to install backdoor plugins on WordPress sites. The company has released updated versions of UpdraftPlus to revoke some keys, but updating the plugin does not remove a backdoor that may already be on a site.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said attackers accessed teamupdraft.com over the weekend of October 17 and 18 and that it believes they reached its customer database. The company said the database held names, email and billing addresses, order history, hashed account passwords, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. It said payment card data was not stored in the database because Stripe and PayPal process payments.

TeamUpdraft released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) to revoke exposed keys. The previous release, 1.26.12, was intended to revoke them but, according to security firm Nethemba, a bug meant it deleted no keys. Nethemba says version 1.26.13 removes keys created before 12:07 UTC on October 18. It reports that keys created between 12:07 and 21:00 UTC that day are not removed by the update and require manual deletion. TeamUpdraft’s stated cutoff is 22:00 British Summer Time, equivalent to 21:00 UTC.

Researchers at Patchstack analyzed the activity and reported that attackers used validly signed dashboard commands to upload and activate plugins. Patchstack counted 99 different plugin names installed between the afternoon of October 18 and 09:23 on October 19; that is a count of names observed in that period, not a measure of affected sites. One recurring plugin description is “Small maintenance toolkit: keeps option storage tidy.” Nethemba said it found the attack on three of its own sites and traced the activity to stolen keys used from an attacker-controlled server.

Why Valid Keys Bypass Site Defenses

The incident matters because the exposed credentials were not merely account passwords: they could authorize remote commands on connected WordPress sites. TeamUpdraft’s UpdraftCentral client is included with UpdraftPlus and remains dormant until connected. Once a site has a connection key, it accepts commands signed with that key, including instructions to install a plugin. Patchstack said the observed commands passed the plugin’s signing checks because they used genuine dashboard keys. Researchers say this meant no software flaw in the site plugin was needed, and sites running the latest version could still be affected.

In the reported backdoor variants, a plugin can create an account, grant it extra capabilities and provide a persistent login cookie that bypasses the ordinary login form. The account may remain after the plugin is deleted, while some variants hide from the plugin list. That makes a routine plugin update an incomplete response: site owners may also need to inspect for unauthorized plugins and accounts and treat a site with evidence of a backdoor as compromised. The full scope is not known, and the researchers’ observations do not establish how many sites were affected.

How UpdraftCentral Keys Reach Sites

UpdraftCentral Cloud is a hosted dashboard for managing multiple WordPress sites. Its connection keys allow that dashboard to send commands to a connected site’s UpdraftPlus client. According to the source material, the option to add a site to UpdraftCentral is checked by default when a TeamUpdraft account is connected in UpdraftPlus settings; Nethemba says the Premium version behaves the same way. As a result, some site owners may have enabled a connection without recognizing that a persistent key was created. Nethemba also reported that keys do not expire and observed keys created in November 2025 being used after the breach.

TeamUpdraft said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected. It also said backups stored directly with services such as Google Drive, Dropbox or Amazon S3 were not affected. However, for sites connected through UpdraftCentral, TeamUpdraft recommends reauthorizing storage and rotating access keys. The company said it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys, rotated payment-provider keys and reported the incident to the UK Information Commissioner’s Office.

“The commands are correctly encrypted and signed with genuine dashboard private keys.”

— Patchstack

The Breach Scope Remains Unknown

TeamUpdraft has not said how many customers or WordPress sites were affected, nor has it published a full account of how attackers first gained access or how long they had access. The company said it believes the database was reached; that wording does not establish that every record or every listed credential was taken. Researchers have reported observed attacks, but their findings do not establish the total number of compromised sites.

There are also practical uncertainties for site owners. Key revocation depends on when a key was created, and Nethemba says some keys from October 18 need manual deletion. New backdoor variants may be identified, and the available cleanup guidance may change. The supplied reports do not establish that every affected site received the same plugin, account name or behavior.

Check Keys and Inspect Sites

Site owners should install the appropriate current UpdraftPlus release and consult TeamUpdraft’s latest advisory for key revocation steps. Those who used UpdraftCentral should check whether a connection remains, determine when its key was created and manually delete keys that fall outside the update’s revocation range, following the vendor’s instructions. TeamUpdraft’s recommendation to reauthorize connected storage and rotate its access keys should also be considered for sites managed through the service.

Owners should separately inspect sites for unfamiliar plugins and administrator-level or otherwise unauthorized accounts. A backdoor may persist after the plugin is removed, so finding one calls for a broader incident response rather than relying on the UpdraftPlus update alone. TeamUpdraft’s investigation and researcher guidance remain ongoing; the company has not announced a count of affected customers or sites.

Key Questions

Does updating UpdraftPlus remove a backdoor?

No. The update revokes some exposed keys, but it does not remove an already installed backdoor plugin or an account that plugin created. Check the site separately and follow current vendor and security-researcher guidance.

Which versions did TeamUpdraft release?

TeamUpdraft released UpdraftPlus 1.26.13 for the free version and 2.26.13 for Premium to revoke keys. Nethemba reported that some keys created during a specific period on October 18 are not removed by the update and require manual deletion.

Were backups stored with Google Drive or Dropbox affected?

TeamUpdraft said backups sent directly to users’ own storage, including Google Drive, Dropbox and Amazon S3, were not affected. It recommends that users who accessed sites through UpdraftCentral reauthorize storage and rotate access keys.

How many sites were compromised?

That has not been disclosed. TeamUpdraft has not provided a total for affected customers or sites. Patchstack counted 99 plugin names observed in a defined period, but that number is not a count of compromised sites.

Source: ThorstenMeyerAI.com