A Gap In The UpdraftCentral Fix Could Leave WordPress Sites Exposed

🔍 Read the full analysis: A Gap In The UpdraftCentral Fix Could Leave WordPress Sites Exposed on ThorstenMeyerAI.com

TeamUpdraft said on October 19, 2026, that attackers had accessed its teamupdraft.com website and may have reached a customer database containing UpdraftCentral Cloud connection keys. Security researchers report that stolen keys were used to install backdoor plugins on connected WordPress sites, including sites running current software versions. TeamUpdraft has released an UpdraftPlus update to revoke some exposed keys, but the update does not remove backdoors already installed.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said the website intrusion took place over the weekend of October 17–18. According to its incident notice, information in the potentially accessed database included customer names, email and billing addresses, order history, password hashes, two-factor authentication settings, and keys associated with UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment-card data; payments are handled by Stripe and PayPal.

The central risk is that an UpdraftCentral key authorizes commands between a connected WordPress site and the remote management dashboard. Patchstack, which analyzed the attack, said an attacker used a command to upload and activate plugins. It counted 99 plugin names used from the afternoon of October 18 through 09:23 UTC on October 19. One recurring marker was the description “Small maintenance toolkit: keeps option storage tidy.” Patchstack said the commands were signed with genuine dashboard keys, so the plugin’s checks accepted them; researchers said the attack did not require a software vulnerability.

TeamUpdraft released UpdraftPlus 1.26.13 and 2.26.13 for the free and Premium editions. The company said the update corrects a problem in the preceding release’s key-revocation process. Nethemba’s code review found that the earlier 1.26.12 release had not deleted keys as intended. Nethemba says version 1.26.13 deletes keys created before 12:07 UTC on October 18, while keys created from 12:07 to 21:00 UTC that day may need to be deleted manually. The update also cannot remove a malicious plugin or account left behind on a site.

Why Stolen Keys Can Control Sites

The incident shows how a breach of a management service can affect websites even when their own plugins are fully patched. UpdraftCentral’s connection key is an authorization credential: once a site accepts it, correctly signed commands can carry out actions such as installing a plugin. In this case, that trusted route was reportedly used to place unauthorized code on connected sites.

For site owners, there are two separate tasks: revoke exposed credentials and check whether a site was already changed. Updating UpdraftPlus addresses only part of the problem. A backdoor may remain after revocation, and the source material says some versions create administrator-level capabilities and a persistent login route. That can leave an attacker with access even if the plugin is later removed, because the account it created may remain.

The exposure could reach site owners who do not recall enabling remote management. The connection option is ticked by default when a TeamUpdraft account is connected in UpdraftPlus settings, according to the source material. Nethemba also reports that older keys did not expire. Those details make it harder for administrators to judge whether they ever created a key or when it was issued.

How the UpdraftCentral Connection Works

UpdraftPlus is a WordPress backup plugin that includes a client for UpdraftCentral, a hosted dashboard for managing multiple sites. The client remains dormant until a connection key is added. According to the researchers cited in the source material, a site then executes commands signed with that key using the permissions associated with the user who created it.

TeamUpdraft said the breach did not affect the UpdraftPlus plugin itself, its downloads or self-hosted UpdraftCentral. It also said backups stored directly with services such as Google Drive, Dropbox or Amazon S3 were not affected. However, for users who relied on UpdraftCentral to access a site, the company recommends reauthorizing storage and rotating access keys. The company said it closed the access route, signed out accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys, rotated payment-provider keys and reported the incident to the UK Information Commissioner’s Office.

Nethemba said it found the attack on three of its own sites and traced the activity to keys used from an attacker-controlled server. It ruled out a modified plugin, weak cryptography and the earlier vulnerability CVE-2026-10795, which was fixed in June 2026 in version 1.26.5. The source characterizes this as a second serious incident involving this channel in five months, though the scale and relationship between the incidents are not detailed.

““Properly apply the revocation in 1.26.12.””

— TeamUpdraft

Scale and Site Status Remain Unknown

TeamUpdraft has not stated how many customers or WordPress sites were affected, nor has it publicly identified the total number of exposed keys. The company said it believes attackers reached the customer database; the precise data accessed and the full duration of access have not been established in the supplied material.

Researchers’ findings identify malicious plugin names and behavior, but the source says variants differ: some hide from the plugin list, and one early version caused HTTP 500 errors before checking its trigger. A site showing an error cannot be assumed safe. Nethemba and Patchstack warn against repairing a broken suspicious plugin, because that may activate its backdoor; they advise removing it. The complete cleanup guidance may change as researchers find additional variants.

The exact scope of key revocation also needs care. Nethemba reports that keys created during part of October 18 were not removed automatically, while TeamUpdraft’s stated cutoff differs from Nethemba’s reported code cutoff. The source material does not provide an independent reconciliation of those times or a full list of affected accounts.

Check Keys and Inspect Sites

Administrators using UpdraftPlus should install the current release and consult the latest TeamUpdraft advisory, as well as the Patchstack and Nethemba analyses, for updated cleanup steps. Because the reported revocation leaves a time window of keys for manual removal, site owners should check whether their UpdraftCentral keys fall within that period and delete affected keys where required.

They should also inspect connected sites for unfamiliar plugins and accounts, including plugins with the maintenance-toolkit description cited by Patchstack. Updating the backup plugin alone is not a cleanup measure for an already compromised site. If a backdoor or unauthorized account is found, treat the site as compromised and follow current incident-response guidance rather than assuming that removing one visible plugin has restored security.

TeamUpdraft’s investigation and researchers’ analysis are ongoing. The next useful updates would clarify the number of affected customers and sites, confirm the full key-revocation scope, and provide any revised vendor guidance for identifying and removing all known backdoor variants.

Key Questions

What was exposed in the TeamUpdraft breach?

TeamUpdraft said attackers may have accessed a customer database containing UpdraftCentral, UpdraftVault and UpdraftClone keys, along with names, contact and billing details, order history, password hashes and two-factor authentication settings. The company said it did not store payment-card data.

Does updating UpdraftPlus remove a backdoor?

No. The update is intended to revoke some exposed keys, but it does not remove a malicious plugin or account already installed on a WordPress site. Sites where suspicious activity is found need separate investigation and cleanup.

Which UpdraftPlus versions include the key fix?

TeamUpdraft released version 1.26.13 for the free edition and 2.26.13 for Premium. The source material says the earlier 1.26.12 release did not revoke keys as intended.

Are all exposed keys automatically revoked?

Not according to Nethemba’s review. It says version 1.26.13 deletes keys created before 12:07 UTC on October 18, 2026, while keys created between 12:07 and 21:00 UTC that day may need manual deletion. Check TeamUpdraft’s latest advisory for current instructions.

Were backups stored in Google Drive or S3 affected?

TeamUpdraft said backups sent to users’ own storage, including Google Drive, Dropbox or Amazon S3, were not affected. For sites accessed through UpdraftCentral, it recommends reauthorizing storage and rotating access keys.

Source: ThorstenMeyerAI.com