🔍 Read the full analysis: Could Your WordPress Site Be Exposed Through Stolen UpdraftCentral Keys? on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
TeamUpdraft said attackers accessed its website and likely reached a customer database containing UpdraftCentral connection keys. Security researchers reported that stolen keys were used to install backdoor plugins on WordPress sites, including fully patched sites. UpdraftPlus 1.26.13 revokes some exposed keys, but owners must also check for backdoors and accounts already added to their sites.
TeamUpdraft said on October 19, 2026, that attackers accessed its website and may have reached a customer database containing UpdraftCentral Cloud connection keys; security researchers report those keys were used to install backdoor plugins on WordPress sites. The company has released updated UpdraftPlus versions to revoke some keys, but updating alone does not remove a backdoor that may already be on a site.
TeamUpdraft, the company behind the UpdraftPlus backup plugin, said attackers accessed the teamupdraft.com website over the weekend of October 17–18. The company believes they reached a customer database containing names, email addresses, billing addresses, order history, hashed account passwords, two-factor authentication settings and keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft said it did not store payment-card details; Stripe and PayPal process payments.
The keys at issue connect a WordPress site to UpdraftCentral Cloud, a hosted dashboard for managing sites. Patchstack’s analysis says attackers used commands signed with genuine keys to upload and activate plugins. That means the affected sites did not need to be running an outdated UpdraftPlus version for the command to work: the authorized connection itself was abused, rather than a software flaw being required.
TeamUpdraft released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) after an earlier release, version 1.26.12, failed to revoke keys because of a bug, according to Nethemba’s code review. Nethemba says the later release deletes keys created before 12:07 UTC on October 18, while some keys created later that day may remain and need manual removal. TeamUpdraft’s stated cutoff was 22:00 British Summer Time, or 21:00 UTC. The company says the plugin itself, its downloads and self-hosted UpdraftCentral were not affected.
Infographic 01 · UpdraftCentral key compromise
Stolen keys, signed commands, backdoored sites.
Keys leaked from TeamUpdraft's customer database let attackers send valid commands to connected WordPress sites. No plugin vulnerability was needed.
Timeline
Times as reported by the named source.
- 17 Oct, evening · Attacker has access to teamupdraft.com (Nethemba)
- 18 Oct, afternoon · First backdoor plugin installed via a signed UpdraftCentral command (Patchstack)
- 19 Oct, 09:23 · Latest backdoor install seen; 99 plugin names in total (Patchstack)
- 19 Oct, 13:00 UTC · TeamUpdraft publishes its incident advisory (Patchstack)
- 19 Oct · UpdraftPlus 1.26.12: key revocation ships, but a bug deletes no key (Nethemba)
- 19 Oct, evening · 1.26.13 fixes it; keys made 18 Oct 12:07–21:00 UTC still remain (Nethemba)
Patchstack and Nethemba analyses are being updated as new variants appear.
What the update does, and doesn’t
Based on Nethemba’s code review and TeamUpdraft’s advisory.
- 1
1.26.12 / 2.26.12
Meant to revoke the stolen keys. Because of a bug, it deleted none (Nethemba).
- 2
1.26.13 / 2.26.13
Revokes UpdraftCentral Cloud keys created before 12:07 UTC on 18 Oct.
- 3
Gap: 18 Oct, 12:07–21:00 UTC
Keys created in this window are not revoked, although the vendor's cutoff is 21:00 UTC.
- 4
Backdoors stay
Revoking a key does not remove an installed backdoor plugin or the account it created.
- 5
Guidance still changing
New backdoor variants keep turning up; vendor and researcher advisories are being updated.
Sources: TeamUpdraft (19 Oct 2026); Patchstack; Nethemba (updated 20 Oct 2026).
Powered by Thorsten Meyer AI
Why Stolen Keys Can Reach Sites
UpdraftCentral keys grant a connected dashboard the ability to send commands to a WordPress site. According to Patchstack, the attacker issued a command to upload a plugin; the site accepted it because it was correctly signed with a genuine dashboard key. The result is a breach path that can bypass the protection owners might expect from keeping WordPress and its plugins patched.
Patchstack counted 99 plugin names installed during the period it examined, from the afternoon of October 18 to 09:23 UTC on October 19. The number is a count of distinct names observed, not a count of affected sites or customers. Some identified plugins created administrator-like accounts and persistent login cookies. Researchers say those accounts can remain even after the malicious plugin is removed, and some versions conceal themselves from the plugin list.
This makes the incident relevant to site owners beyond those who knowingly used the hosted dashboard. UpdraftPlus includes an UpdraftCentral client, and the option to add a site to remote management is selected by default when connecting a TeamUpdraft account, according to the source report. A site may therefore have had a connection key without its owner remembering that remote management was enabled.
Popular right now
LG 77-Inch OLED evo C6 4K Smart TV
Ninja Crispi Microwave and Air Fryer with FusionCrisp, Silver, MW101
Bose QuietComfort Wireless Noise-Cancelling Headphones, Sandstone
As an affiliate, we earn on qualifying purchases.
How the Exposure Developed
TeamUpdraft said it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also reported the incident to the UK Information Commissioner’s Office. The company has not disclosed how many customers or WordPress sites may be affected.
Researchers at Nethemba said they found the attack on three of their own sites and traced the activity to stolen UpdraftCentral Cloud keys used from an attacker-controlled server. Nethemba said it ruled out a modified plugin, weak cryptography and the earlier key-forgery vulnerability CVE-2026-10795, which was fixed in June in UpdraftPlus 1.26.5. The source report describes this as a second serious incident involving this channel within five months.
TeamUpdraft says backups stored with customers’ own services, such as Google Drive, Dropbox or Amazon S3, were not affected. However, the company recommends re-authorizing those storage connections and rotating their access keys if UpdraftCentral was used to access the site. That advice is separate from revoking the UpdraftCentral key and checking the site for unauthorized changes.
““The commands are correctly encrypted and signed with genuine dashboard private keys.””
— Patchstack
What Owners Still Need to Check
The total number of affected customers, connection keys and WordPress sites remains unknown. TeamUpdraft has not published a full account of the breach’s scope, and researchers say malicious plugin variants differ. The key revocation also has limits: Nethemba reports that keys created between 12:07 and 21:00 UTC on October 18 are not removed by the update and must be deleted manually. The exact status of an individual site therefore depends on whether it had a key, when that key was created and whether an attacker used it.
Installing the updated plugin does not establish that a site is clean. Researchers warn that removing a backdoor plugin alone may leave behind an account or persistent access, while some variants may be hidden. Nethemba and Patchstack also warn against trying to repair an early variant that causes HTTP 500 errors: changing it could allow its backdoor code to run. The source material does not provide a definitive cleanup checklist that covers every variant, and guidance may change as analysis continues.
Next Steps for Site Administrators
Administrators should install the applicable current UpdraftPlus release and consult TeamUpdraft’s latest incident advisory for key-revocation instructions. If a site was connected to UpdraftCentral Cloud, owners should verify whether its key falls within the affected period and remove keys that the update does not revoke. They should also review installed plugins and user accounts for unexpected entries, including accounts with unfamiliar names or email addresses ending in @example.org, a marker described by researchers.
If a suspicious plugin or account is found, owners should treat the site as potentially compromised rather than assume a plugin update has resolved the problem. They may need specialist incident-response help to identify and remove remaining access, and should review relevant storage authorizations and rotate credentials where advised. TeamUpdraft’s investigation, researcher analyses and cleanup guidance remain developing; site owners should check the latest versions of those advisories before deciding a site is clear.
Key Questions
Does updating UpdraftPlus remove a backdoor?
No. TeamUpdraft’s update is intended to revoke certain exposed connection keys. It does not remove a backdoor plugin or an account that may already have been added to a WordPress site.
Which UpdraftPlus versions did TeamUpdraft release?
TeamUpdraft released version 1.26.13 for the free plugin and 2.26.13 for Premium. The source report says the preceding 1.26.12 release did not revoke keys as intended; check TeamUpdraft’s current advisory for the latest instructions.
Were customer backups or payment-card details exposed?
TeamUpdraft said customer payment-card details were not stored in the affected database and that Stripe and PayPal handle payments. It also said backups stored in customers’ own services, such as Google Drive, Dropbox or Amazon S3, were not affected. It recommends re-authorizing storage and rotating access keys if UpdraftCentral was used.
How can a site owner check for a backdoor?
Review plugins and user accounts for unfamiliar entries, including plugins described as a small maintenance toolkit and accounts with unexpected names or @example.org addresses, as described by researchers. Because some variants may hide themselves and leave accounts behind, a clean-looking plugin list alone may not prove a site is uncompromised.
Source: ThorstenMeyerAI.com
