WordPress Site Backdoors Raise Questions About The UpdraftCentral Key Fix

🔍 Read the full analysis: WordPress Site Backdoors Raise Questions About The UpdraftCentral Key Fix on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the little things that make your day delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft said on October 19 that attackers accessed its teamupdraft.com website and may have reached a customer database containing keys for UpdraftCentral Cloud, a service used to manage WordPress sites remotely. Security researchers say attackers used stolen keys to install backdoor plugins on connected sites, including sites running current software versions. The company released an UpdraftPlus update to revoke affected keys, but that step does not remove malicious plugins or accounts already installed.

In its incident notice, TeamUpdraft said the website was accessed over the weekend of October 17 and 18 and that it believes attackers reached the customer database. The company said the database included names, email addresses, billing addresses, order history, password hashes, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. It said payment card details were not stored there because Stripe and PayPal process payments.

TeamUpdraft said it closed the access route, signed out accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also reported the breach to the UK Information Commissioner’s Office. The company said the UpdraftPlus plugin’s downloads and self-hosted UpdraftCentral were not affected. It has not disclosed how many customers or WordPress sites may be affected.

TeamUpdraft released UpdraftPlus versions 1.26.13 and 2.26.13, for the free and Premium products, respectively. The update is intended to revoke exposed UpdraftCentral Cloud keys. Security firm Nethemba reported that the preceding version, 1.26.12, failed to delete the keys because of a bug. Nethemba’s analysis says version 1.26.13 removes keys created before 12:07 UTC on October 18, but not keys created between then and 21:00 UTC that day. Those keys require manual removal, according to the firm.

Why a Dashboard Key Could Install Backdoors

The incident shows how a legitimate remote-management feature can become an attack route when its credentials are exposed. According to Patchstack’s analysis, UpdraftPlus’s UpdraftCentral client accepts commands signed with a valid connection key and carries them out with the permissions of the user who created the key. The attacker reportedly sent a command to upload a plugin; WordPress then installed and activated it. Patchstack said the commands were correctly signed with genuine dashboard keys, so the plugin’s security checks accepted them.

This means the reported attacks did not depend on exploiting a software vulnerability in an up-to-date installation. Sites with a valid exposed key could be affected even if their plugin was current. TeamUpdraft says backups stored directly in services such as Google Drive, Dropbox or Amazon S3 were not affected by the breach. However, the company recommends re-authorising storage and rotating access keys if UpdraftCentral was used to access the site.

The cleanup issue matters as much as the key revocation. A site may remain compromised after its owner updates UpdraftPlus: the malicious plugin and any account it created can persist. Owners and administrators therefore need to inspect affected sites and follow current vendor and researcher guidance, rather than treating the software update alone as proof that a site is clean.

How the Stolen Keys Were Used

UpdraftCentral Cloud lets site owners manage multiple WordPress installations from a hosted dashboard. The source material says the UpdraftCentral client is included in UpdraftPlus and remains dormant until a connection key is added. It also reports that when users connect a TeamUpdraft account in UpdraftPlus settings, the option to add the site to remote UpdraftCentral control is selected by default. Nethemba said keys do not expire and reported seeing keys created in November 2025 used after the breach.

Patchstack counted 99 plugin names installed between the afternoon of October 18 and 09:23 on October 19. Names included “Site Health Cache,” “Seo Helper,” “Wp Forge” and “Js Clean.” The researchers identified a recurring plugin description, “Small maintenance toolkit: keeps option storage tidy,” as a useful indicator. According to the source material, the malicious plugins could create accounts, grant them elevated capabilities, and log an attacker in using a persistent cookie. Some variants reportedly hid themselves from the plugin list.

Nethemba said it found the activity on three of its own sites and attributed it to keys leaked from the UpdraftCentral Cloud environment. The firm said its investigation did not point to a modified plugin, weak cryptography or the older forgery issue CVE-2026-10795, which it said was fixed in June in version 1.26.5. Those findings are the researchers’ conclusions, not a disclosed count of all affected sites.

“The commands are correctly encrypted and signed with genuine dashboard private keys.”

— Patchstack

Affected Sites and Cleanup Still Unclear

TeamUpdraft has not said how many customer records, connection keys or WordPress sites were affected, or how many sites received a backdoor. The exact reach of the breach remains unknown. The company has also not provided a public count of keys that require manual removal. According to Nethemba, keys created between 12:07 and 21:00 UTC on October 18 fall outside the deletion performed by version 1.26.13, while TeamUpdraft’s stated cutoff is 22:00 BST, equivalent to 21:00 UTC.

Researchers have described variations in the backdoor behavior. The source material says one early version could cause HTTP 500 errors before checking for its secret token, and that repairing the error could allow the backdoor to operate. That warning is attributed to Nethemba and Patchstack; it does not establish that every affected site has this version. The recommended indicators and cleanup steps may change as more variants are found. It is also not clear whether every exposed key was used or whether all malicious plugins have been identified.

Owners Need to Check Keys and Sites

WordPress site owners using UpdraftPlus should install the relevant update and consult the latest TeamUpdraft advisory alongside Patchstack’s and Nethemba’s analyses. Updating addresses only the key-revocation part of the response: administrators should also check for unfamiliar plugins and user accounts, paying attention to the indicators reported by researchers. If a backdoor is found, removing the plugin and investigating any account it created are separate steps; the source material warns that removing the plugin may not remove the account.

Owners who used UpdraftCentral to reach their sites should follow TeamUpdraft’s guidance to re-authorise connected storage and rotate access keys. The company and researchers may issue revised cleanup instructions as they learn more. Until a site has been checked, administrators should not assume that a successful plugin update has removed an existing compromise.

Key Questions

What happened in the TeamUpdraft breach?

TeamUpdraft said attackers accessed teamupdraft.com over the October 17–18 weekend and may have reached a customer database containing UpdraftCentral Cloud connection keys. Patchstack and Nethemba reported that stolen keys were used to install backdoors on WordPress sites.

Does UpdraftPlus 1.26.13 remove a backdoor?

No. The update is intended to revoke some exposed keys. It does not remove a malicious plugin or account already installed on a site, so administrators need to inspect and clean affected installations separately.

Which keys may need manual removal?

Nethemba reported that version 1.26.13 does not delete keys created between 12:07 and 21:00 UTC on October 18, 2026. The firm says those keys must be removed manually. Follow the current TeamUpdraft advisory for instructions and updates.

Were payment cards or third-party backups exposed?

TeamUpdraft said it did not store payment card details because Stripe and PayPal handle payments. It also said backups sent directly to storage such as Google Drive, Dropbox or Amazon S3 were not affected, while recommending that users who accessed sites through UpdraftCentral re-authorise storage and rotate access keys.

How can an administrator check for a reported backdoor?

Researchers cited unfamiliar plugins, including names such as “Site Health Cache,” and the description “Small maintenance toolkit: keeps option storage tidy.” They also described suspicious accounts with elevated permissions. These indicators are not a complete guarantee of detection; consult the current vendor and researcher guidance for site-specific cleanup steps.

Source: ThorstenMeyerAI.com