The UpdraftCentral Security Fix Has A Gap Amid Stolen Key Attacks

🔍 Read the full analysis: The UpdraftCentral Security Fix Has A Gap Amid Stolen Key Attacks on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get hardware and tech essentials delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft confirmed on October 19 that attackers accessed its website and likely reached a customer database containing keys for UpdraftCentral Cloud, which can send commands to connected WordPress sites. Security researchers say attackers used those keys to install backdoor plugins, and that the company’s latest UpdraftPlus update still leaves some keys from a defined time window unrevoked.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said attackers accessed teamupdraft.com over the weekend of October 17–18. The company believes they reached its customer database. According to its incident post, the database contained names, email and billing addresses, order histories, hashed account passwords, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft said it did not store payment-card data; Stripe and PayPal handle payments.

TeamUpdraft says the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected. It released free UpdraftPlus 1.26.13 and Premium 2.26.13 to revoke exposed UpdraftCentral keys. But Nethemba’s code review found that the earlier 1.26.12 release did not delete keys as intended. The subsequent version corrects that issue, but Nethemba says it deletes keys created before 12:07 UTC on October 18, leaving keys created between then and 21:00 UTC undeleted. Those keys require manual removal, according to the firm.

Patchstack reported that attackers used the command plugin.upload_plugin to install and activate plugins. It counted 99 different plugin names deployed between the afternoon of October 18 and 09:23 UTC on October 19. A recurring description—“Small maintenance toolkit: keeps option storage tidy”—is one indicator researchers identified. The malicious plugin can create a privileged account and establish a persistent login, according to Patchstack and Nethemba. Removing the plugin alone may not remove that account.

Why Stolen Keys Bypass Patching

The incident shows why a software update can be necessary without being a complete cleanup. UpdraftCentral keys authorize commands from a dashboard to connected sites. Patchstack says the commands used in this attack were properly signed with genuine dashboard keys, so the client’s checks accepted them. Researchers say the attack did not require a newly exploited flaw in UpdraftPlus, and that sites running current versions could still be affected if their connection keys were stolen.

For site owners, the risk is not limited to whether the plugin is up to date. A malicious plugin may create an administrator-level account or another account with powerful permissions, and that access can remain after the plugin is deleted. A backdoor can also be hidden from the plugin list. That makes the breach relevant to anyone who connected a site to UpdraftCentral Cloud, including users who may not recall enabling remote management.

TeamUpdraft recommends re-authorizing storage and rotating its access keys if UpdraftCentral was used to access a site. The company says backups sent directly to services such as Google Drive, Dropbox or Amazon S3 were not affected by the database breach. However, a compromised WordPress site may create separate risks to credentials or data accessible from that site. Readers should distinguish the reported database exposure from any confirmed compromise of their own site; the company has not published a count of affected customers or websites.

How UpdraftCentral Keys Work

UpdraftPlus includes a client for UpdraftCentral, which allows a site owner to manage multiple WordPress sites from a central dashboard. The client remains dormant until a connection key is used. According to Patchstack’s analysis, a connected site accepts commands signed with that key, including commands to install plugins, with permissions tied to the user who created the connection.

Nethemba reports that connecting a TeamUpdraft account through UpdraftPlus settings can enable the option to add a site to UpdraftCentral by default; it says the Premium version behaves similarly. The firm also found keys created in November 2025 being used after this breach, indicating that keys may remain valid for long periods. Nethemba says it investigated activity on three of its own sites and attributed the commands to keys exposed from the UpdraftCentral Cloud environment. It ruled out a modified plugin, weak cryptography and the older vulnerability CVE-2026-10795, which was fixed in version 1.26.5 in June, according to its analysis.

TeamUpdraft says it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also reported the incident to the UK Information Commissioner’s Office. Those response steps address access and credentials, but they do not by themselves establish whether an individual WordPress site has a backdoor.

“The commands are correctly encrypted and signed with genuine dashboard private keys.”

— Patchstack

What the Breach Has Not Established

The number of affected customers and sites is unknown. TeamUpdraft has not said how many database records were accessed or how many WordPress installations received a malicious plugin. The source material also does not establish whether every exposed key was used or whether every site with a suspicious plugin was compromised in the same way.

Researchers say keys created between 12:07 and 21:00 UTC on October 18 are not removed by version 1.26.13 and need manual deletion. The precise set of keys requiring action depends on their creation time and the applicable cutoff. Cleanup guidance is still developing as researchers identify variants. The supplied reports do not provide a complete list of all affected sites or confirm that every backdoor variant has been found.

It is also not clear how many people had two-factor authentication settings exposed. The sources describe those settings as present in the database but do not say that attackers bypassed account authentication through them. The reported persistent login behavior concerns accounts created by the backdoor on compromised WordPress sites, not proof that all TeamUpdraft customer accounts were taken over.

Key Revocation and Site Checks

TeamUpdraft customers should consult the company’s current advisory and install the applicable UpdraftPlus update, while recognizing that the update does not remove an installed backdoor or account. Site owners who used UpdraftCentral should review connection keys, manually remove any key that falls within the reported gap, and re-authorize connected storage and rotate its access credentials as TeamUpdraft recommends.

Researchers advise checking for suspicious plugin names and the recurring “Small maintenance toolkit” description, along with unexpected accounts and unexplained administrator-level permissions. A site showing the reported HTTP 500 behavior should not be treated as clean simply by repairing the error; Nethemba and Patchstack say to remove the suspicious plugin and assess the site for remaining access. Because some variants hide themselves, the absence of a visible plugin is not conclusive proof that a site was unaffected.

TeamUpdraft’s investigation, the scale of exposure and updated cleanup guidance remain ongoing. The company has not announced a count of affected customers or sites. Site owners should follow later notices from TeamUpdraft and the researchers as the key-revocation window and backdoor indicators are clarified.

Key Questions

What did attackers access?

TeamUpdraft said attackers accessed teamupdraft.com and that it believes they reached a customer database. The database held contact and billing details, order history, hashed passwords, two-factor authentication settings and connection keys. The company said it did not store payment-card data.

Does UpdraftPlus 1.26.13 remove a backdoor?

No. The update revokes many older UpdraftCentral keys, but it does not remove a malicious plugin or account already installed on a WordPress site. Those require separate investigation and cleanup.

Which exposed keys may remain active?

Nethemba says version 1.26.13 removes keys created before 12:07 UTC on October 18, 2026, but not those created between that time and 21:00 UTC that day. The firm says keys in that interval must be deleted manually.

Were backups stored with Google Drive or Amazon S3 exposed?

TeamUpdraft said backups sent to users’ own storage, including Google Drive, Dropbox or Amazon S3, were not affected by the database breach. It recommends re-authorizing that storage and rotating access keys if UpdraftCentral was used to access the site.

How many sites were affected?

TeamUpdraft has not published the number of affected customers or WordPress sites. Patchstack reported 99 different plugin names used in attacks during the period it analyzed, but that is a count of plugin names, not a count of affected sites.

Source: ThorstenMeyerAI.com