How To Review The UpdraftCentral Key Risk Behind WordPress Backdoors

🔍 Read the full analysis: How To Review The UpdraftCentral Key Risk Behind WordPress Backdoors on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft disclosed on October 19 that attackers accessed its teamupdraft.com website and may have reached a customer database containing UpdraftCentral Cloud connection keys. Security researchers say the stolen keys were then used to install backdoor plugins on WordPress sites, including sites running current software versions; updating UpdraftPlus alone does not remove those backdoors.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said the website was accessed over the weekend of October 17–18. Its incident notice says the database may have contained customer names, email addresses, billing addresses, order histories, hashed passwords, two-factor authentication settings and keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment card details; Stripe and PayPal handle payments.

TeamUpdraft said the UpdraftPlus plugin, its downloads and self-hosted UpdraftCentral were not affected. It released UpdraftPlus 1.26.13 and 2.26.13 Premium to revoke exposed keys. However, researcher Nethemba found the preceding 1.26.12 release did not revoke keys as intended. Nethemba says version 1.26.13 removes keys created before 12:07 UTC on October 18, while some keys created later that day may need to be deleted manually.

Patchstack’s analysis says attackers used genuine dashboard keys to send a command to upload and activate a plugin. It counted 99 plugin names installed between the afternoon of October 18 and 09:23 on October 19. One recurring indicator is the description, “Small maintenance toolkit: keeps option storage tidy.” Researchers say some backdoors create administrator-like access, use persistent login cookies and may remain hidden in the plugin list. The affected sites and total number of installations are not known.

Why Key Revocation Is Not Cleanup

The incident shows how a legitimate remote-management connection can become a route into a website when its credentials are exposed. UpdraftCentral keys authorize commands on connected sites, so attackers did not need to exploit a software flaw or bypass the plugin’s signature checks. Patchstack says fully patched sites were also affected because the commands were signed with genuine keys.

For site owners, installing the updated plugin addresses only part of the risk. The update’s revocation does not remove a plugin that an attacker already installed, delete accounts created by a backdoor or necessarily cover every key from the exposure window. A site with evidence of a backdoor should be treated as compromised while its files, accounts and access credentials are reviewed.

The breach may also affect customer privacy beyond site access. TeamUpdraft lists contact, billing and account information among the data in the database, though it has not said how many records were accessed. The company says it has reported the incident to the UK Information Commissioner’s Office and taken steps to close access and rotate or replace certain keys.

How UpdraftCentral Keys Work

UpdraftPlus includes a client for UpdraftCentral, a hosted dashboard for managing multiple WordPress sites. The client remains inactive until connected, after which a site accepts commands signed with the relevant key and carries them out with the permissions associated with that connection. According to Nethemba, connecting a TeamUpdraft account can leave the option to add a site to UpdraftCentral selected by default, potentially creating keys a site owner may not recall authorizing.

Nethemba says keys do not expire automatically and reported finding keys created in November 2025 that were used after the breach. The firm said it found the activity on three of its own sites and attributed it to leaked UpdraftCentral Cloud keys, rather than a modified plugin, weak cryptography or the older forgery issue CVE-2026-10795, which was fixed in June in version 1.26.5. Those are the researchers’ findings, not a full public forensic account from TeamUpdraft.

““The commands are correctly encrypted and signed with genuine dashboard private keys.””

— Patchstack

Affected Sites and Keys Remain Unknown

TeamUpdraft has not disclosed how many customers or WordPress sites were affected, nor the full scope of data accessed. It is also unclear how many exposed keys were used, whether all observed backdoor variants have been identified, and whether every relevant key has been revoked. Nethemba’s reported cutoff and TeamUpdraft’s stated cutoff differ for some October 18 keys, making it important for site owners to consult current vendor guidance rather than assume all connections were covered.

Researchers describe backdoor behavior that can vary between plugin versions. Some variants may hide themselves; one early variant reportedly caused HTTP 500 errors before reaching its token check. Nethemba and Patchstack warn against trying to repair that error, because doing so may activate the backdoor. Further cleanup guidance may change as researchers identify additional variants.

Check Connections and Remove Backdoors

Site owners should update to the relevant UpdraftPlus 1.26.13 or Premium 2.26.13 release and review TeamUpdraft’s latest incident instructions alongside the Patchstack and Nethemba analyses. They should inspect connected sites for suspicious plugins, including entries matching reported names or descriptions, and look for unexpected accounts and access. A plugin update should not be treated as proof that a site is clean.

Where UpdraftCentral was used, TeamUpdraft recommends re-authorizing external storage connections and rotating access keys. Owners should also determine whether their keys fall within the window that requires manual deletion. If a backdoor is found, researchers advise removing it rather than repairing a broken variant; site owners should also investigate unauthorized accounts and credentials. TeamUpdraft’s incident response and researchers’ cleanup recommendations remain developing, so affected administrators should check for revised guidance.

Key Questions

Did the UpdraftPlus plugin itself have a vulnerability?

TeamUpdraft said UpdraftPlus itself and its downloads were not affected. Patchstack and Nethemba report that attackers used exposed, valid UpdraftCentral keys rather than exploiting a plugin vulnerability to issue the commands.

Is updating UpdraftPlus enough to secure a site?

No. Version 1.26.13 revokes some keys, but it does not remove an already installed backdoor or accounts created by one. Site owners should separately inspect connected sites and follow current cleanup advice.

What information may have been exposed?

TeamUpdraft says the customer database may have included names, email and billing addresses, order histories, hashed passwords, two-factor settings and service connection keys. It says payment card data was not stored in the database.

How can a site owner look for a reported backdoor?

Researchers cite suspicious plugins and the description “Small maintenance toolkit: keeps option storage tidy” as indicators, along with unexpected accounts. These signs are not an exhaustive detection list; owners should consult the latest Patchstack, Nethemba and TeamUpdraft guidance.

Were backups stored on Google Drive or similar services affected?

TeamUpdraft says backups sent directly to storage such as Google Drive, Dropbox or Amazon S3 were not affected. For sites connected through UpdraftCentral, it recommends re-authorizing storage and rotating access keys.

Source: ThorstenMeyerAI.com