What WordPress Site Owners Should Know About Stolen UpdraftCentral Keys

🔍 Read the full analysis: What WordPress Site Owners Should Know About Stolen UpdraftCentral Keys on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft, the company behind the UpdraftPlus WordPress backup plugin, confirmed on October 19, 2026, that attackers accessed its website and likely reached a customer database containing UpdraftCentral Cloud connection keys. Security researchers say attackers used some of those keys to install backdoor plugins on WordPress sites, including sites running current software versions. TeamUpdraft has released updates intended to revoke exposed keys, but updating alone does not remove a backdoor already installed on a site.

TeamUpdraft said the attackers accessed teamupdraft.com over the weekend of October 17–18 and that the company believes they reached its customer database. According to its incident post, the database included names, email and billing addresses, order history, hashed account passwords, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment card details; Stripe and PayPal process payments.

TeamUpdraft said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected. It closed the access route, signed out accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also reported the incident to the UK Information Commissioner’s Office. The company has not disclosed how many customers or WordPress sites may be affected.

UpdraftCentral Cloud lets customers manage multiple WordPress sites through a hosted dashboard. A site connected to the dashboard accepts commands authenticated with its connection key. Patchstack’s analysis says attackers used the command plugin.upload_plugin to upload and activate plugins. Patchstack reported that the commands were correctly signed with genuine dashboard keys, meaning the affected sites did not need to have an unpatched software flaw for the commands to run.

Why Key Theft Can Control a Site

The incident matters because an exposed connection key can act as an authorized route to a connected WordPress site. According to Patchstack, the attack used the system’s intended command mechanism rather than exploiting a vulnerability in an outdated UpdraftPlus version. That means patching the plugin does not, by itself, prove a site was untouched.

Nethemba said it found the attack on three of its own sites and traced the activity to keys used from the attacker’s server. The firm reported that keys could remain active indefinitely and that some users may have created one without realizing it: the option to add a site to UpdraftCentral is selected by default when connecting a TeamUpdraft account in UpdraftPlus settings. Nethemba said it observed keys dating to November 2025 being used after the breach.

Patchstack counted 99 different plugin names installed in the observed activity between the afternoon of October 18 and 09:23 on October 19. That is a count of names seen during that period, not a total of affected sites. Researchers described variants that create unauthorized accounts with elevated capabilities and can maintain access through persistent login cookies. Some hide from the WordPress plugin list, and researchers warn that deleting a malicious plugin may not remove accounts it created.

How the Revocation Patch Works

TeamUpdraft released UpdraftPlus 1.26.12 on October 19, intending to revoke UpdraftCentral Cloud keys created before the incident. Nethemba reported that a bug meant this version did not delete keys. TeamUpdraft then released versions 1.26.13 (free) and 2.26.13 (Premium), with a changelog note stating that the revocation in 1.26.12 had been properly applied.

Nethemba’s code review found that version 1.26.13 deletes keys created before 12:07 UTC on October 18. The source material says keys created between 12:07 and 21:00 UTC that day are not deleted automatically and require manual removal. TeamUpdraft’s stated cutoff is 22:00 British Summer Time, equivalent to 21:00 UTC. These differences make it important for site owners to follow the vendor’s current instructions and check the creation time of their keys rather than assuming the update removed every exposed credential.

Researchers also said backup files stored directly in customers’ own services, such as Google Drive, Dropbox or Amazon S3, were not affected by the breach. However, TeamUpdraft recommends re-authorizing those storage connections and rotating access keys if UpdraftCentral was used to access the site.

“The commands are correctly encrypted and signed with genuine dashboard private keys.”

— Patchstack

Affected Sites and Keys Still Uncounted

TeamUpdraft has not said how many customers, keys or WordPress sites were affected, or published a complete account of the attackers’ access and activity. The company says it believes attackers reached the customer database; the precise amount of data accessed has not been disclosed in the supplied incident information.

The scope of key exposure also remains important to verify site by site. Nethemba’s findings identify a time window in which some keys are not automatically revoked, while connections created after the cutoff are left in place. Researchers continue to report new backdoor variants, and cleanup guidance may change as analysis develops. A failed or broken site is not proof of infection, but Nethemba and Patchstack warn against trying to repair a suspicious plugin before removing it, since some variants may activate after a request error is fixed.

Check Connections and Remove Persistence

Site owners should install the current UpdraftPlus release and consult the latest TeamUpdraft advisory alongside Patchstack’s and Nethemba’s analyses. They should review whether each site was connected to UpdraftCentral Cloud, check the creation date of its connection key, and manually revoke any key that falls within the unrevoked interval described by Nethemba. If the dashboard was used to reach a site, owners should follow TeamUpdraft’s guidance on re-authorizing backup storage and rotating its access credentials.

Owners should also inspect for unfamiliar plugins and administrator-level capabilities, including plugins with the reported maintenance-toolkit description and unexpected accounts with names such as data-ops or media-staff. If a backdoor is found, updating UpdraftPlus is not a substitute for incident cleanup: remove the malicious plugin, investigate and remove unauthorized accounts and other persistence, and treat the site as compromised. TeamUpdraft’s investigation and researcher guidance remain the sources to watch for revised findings and instructions.

Key Questions

Does updating UpdraftPlus remove an installed backdoor?

No. The update is intended to revoke certain exposed connection keys, but researchers and the vendor guidance described here say it does not remove a malicious plugin or accounts already created on a site. Check the site separately for signs of compromise.

Which UpdraftPlus versions include the key revocation?

TeamUpdraft released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) after an issue with the earlier 1.26.12 revocation. Nethemba reported that 1.26.13 revokes keys created before 12:07 UTC on October 18, 2026; some keys created later that day may need manual removal.

Were backup files in Google Drive or Dropbox exposed?

TeamUpdraft said backups stored in customers’ own services, including Google Drive, Dropbox and Amazon S3, were not affected. It recommends re-authorizing storage and rotating access keys if UpdraftCentral was used to access the site.

How can a site owner look for the reported backdoor?

Researchers reported suspicious plugins with descriptions such as “Small maintenance toolkit: keeps option storage tidy,” along with unfamiliar accounts and unexpected plugin capabilities. Some variants may hide from the plugin list, so follow current guidance from TeamUpdraft and the security researchers rather than relying on one indicator.

How many sites were affected?

TeamUpdraft has not disclosed a total number of affected customers or sites. Patchstack’s count of 99 refers to different plugin names observed during a specified period, not to the number of compromised sites.

Source: ThorstenMeyerAI.com