How Stolen UpdraftCentral Keys Are Backdooring WordPress Sites—and Where The Fix Falls Short

🔍 Read the full analysis: How Stolen UpdraftCentral Keys Are Backdooring WordPress Sites—and Where The Fix Falls Short on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get movie nights delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft disclosed a breach on October 19 after attackers accessed its teamupdraft.com website and may have reached a customer database containing UpdraftCentral Cloud connection keys. Security researchers report that attackers used stolen keys to install backdoor plugins on connected WordPress sites, including sites running current software; the company’s UpdraftPlus updates revoke some keys but do not remove backdoors already installed.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said attackers accessed its website over the weekend of October 17-18 and that it believes they reached its customer database. According to the company’s incident notice, the data included names, email addresses, billing addresses, order history, hashed account passwords, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment-card data; Stripe and PayPal process payments.

Patchstack’s analysis found commands that uploaded and activated plugins on affected sites. The malicious commands were signed with genuine UpdraftCentral keys, allowing them to pass the plugin’s checks. This was not reported as an exploit of an UpdraftPlus software flaw: a connected site accepts commands signed with its key, and those commands can carry the permissions of the user who created the connection. Researchers say fully patched sites could be affected.

TeamUpdraft released UpdraftPlus 1.26.13 and UpdraftPlus Premium 2.26.13 to revoke exposed keys. Nethemba’s review found that the preceding 1.26.12 release did not delete keys as intended. The newer release deletes keys created before 12:07 UTC on October 18, according to Nethemba; some keys created later that day may require manual deletion. Updating also does not remove a backdoor plugin or an account it created.

Why a Valid Key Could Install a Backdoor

The incident highlights a risk that differs from a conventional plugin vulnerability. UpdraftCentral keys authorize remote commands; an attacker holding a valid key can issue commands that the connected site treats as legitimate. Patchstack said the observed command uploaded a plugin, which WordPress then installed and activated. Because the command passed the plugin’s signing checks, simply installing the latest software version would not prevent use of a stolen key.

The reported backdoors can create accounts with elevated permissions and maintain access through persistent login cookies, according to the researchers. Patchstack said some variants hide themselves in the plugin list, and removing a malicious plugin may not delete the account it created. Site owners therefore need to treat suspected infections as a separate incident-response problem, rather than assuming a software update restores the site.

The exposure may reach sites whose owners do not recall enabling remote management. The UpdraftPlus connection option to add a site to UpdraftCentral is selected by default when connecting a TeamUpdraft account, according to the supplied research. Nethemba also reported seeing older keys used after the breach, consistent with keys that do not expire. Those details make reviewing existing connections and key creation dates relevant even for owners who did not recently change settings.

Popular right now

Shark NV752 Rotator Powered Lift-Away TruePet Upright Vacuum, Bordeaux

AmazonView Latest Price

Ninja CREAMi Scoop & Swirl 13-in-1 Ice Cream and Soft Serve Maker, NC701

AmazonView Latest Price

Dyson Airwrap i.d. Multi-Styler for Straight and Wavy Hair

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

How the UpdraftCentral Connection Works

UpdraftPlus includes a client for UpdraftCentral, a dashboard for managing multiple WordPress sites. The client remains inactive until a connection key is used to link a site. Once connected, commands signed with that key can be carried out with the permissions associated with the user who created it. The reported attack abused that authorized channel rather than modifying the plugin itself.

Patchstack counted 99 different plugin names installed during the activity it examined, from the afternoon of October 18 through 09:23 on October 19. Names included “Site Health Cache,” “Seo Helper,” “Wp Forge” and “Js Clean.” Researchers identified the recurring description “Small maintenance toolkit: keeps option storage tidy” as a possible indicator. Nethemba said it found the attack on three of its own sites and ruled out a modified plugin, weak cryptography and the earlier forgery bug CVE-2026-10795, which was fixed in June in version 1.26.5.

TeamUpdraft said it closed the access route, signed out accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys, rotated keys with payment providers and reported the incident to the UK Information Commissioner’s Office. It said backups sent to customers’ own storage, such as Google Drive, Dropbox or Amazon S3, were not affected. For sites that used UpdraftCentral, however, the company recommends reauthorizing storage and rotating its access keys.

“The commands are correctly encrypted and signed with genuine dashboard private keys.”

— Patchstack

How Many Sites Remain Exposed

The number of affected customers and WordPress sites is not known from the company’s disclosure. TeamUpdraft has not published a total, and the research figures describe activity observed by individual security firms rather than a complete count of compromised sites.

There is also a key-revocation gap described by Nethemba: keys created between 12:07 and 21:00 UTC on October 18 were not removed by version 1.26.13, despite a company cutoff cited as 22:00 BST. Owners may need to identify and delete those keys manually. The supplied information does not establish how many such keys remain active or whether every malicious plugin variant has been identified. Researchers and the vendor may revise cleanup guidance as additional variants are found.

Update, Revoke, Then Inspect Sites

Site owners should install the applicable UpdraftPlus update, then review their UpdraftCentral connections and key creation dates rather than assuming the update alone has removed every exposed credential. Keys in the interval identified by Nethemba may need manual removal. Owners who used UpdraftCentral should also follow TeamUpdraft’s current advice on reauthorizing remote storage and rotating associated access keys.

Researchers advise inspecting connected sites for suspicious plugins and unauthorized administrator-capable accounts. If a suspected backdoor is present, remove it and investigate the account and other persistence mechanisms it may have left behind. Nethemba and Patchstack warn against repairing a malicious plugin that causes HTTP 500 errors: removing the plugin is the recommended response, since restoring its operation could allow its backdoor logic to run. Site owners should continue checking updated guidance from TeamUpdraft, Patchstack and Nethemba as incident analysis develops.

Key Questions

Does installing UpdraftPlus 1.26.13 remove a backdoor?

No. The update revokes some UpdraftCentral keys, but it does not remove a malicious plugin or accounts already created on a site. Sites need a separate inspection and cleanup.

Were all UpdraftPlus users affected?

The available information does not show how many users or sites were affected. The reported attack involved sites connected through UpdraftCentral keys; the company has not published a total.

What should site owners look for?

Researchers identified suspicious plugins, including names such as “Site Health Cache,” and the description “Small maintenance toolkit: keeps option storage tidy.” They also reported unauthorized accounts with elevated capabilities. These are indicators from the observed activity, not a complete list of every variant.

Were customer payment details or personal backups exposed?

TeamUpdraft said it did not store payment-card data because Stripe and PayPal handle payments. It also said backups stored in customers’ own services, including Google Drive, Dropbox and Amazon S3, were not affected. The company said the database did contain personal and account information, including hashed passwords and connection keys.

Do site owners need to rotate cloud-storage credentials?

TeamUpdraft recommends reauthorizing storage and rotating access keys for sites that used UpdraftCentral. Owners should follow the company’s current advisory, particularly if a site may have been compromised.

Source: ThorstenMeyerAI.com