The UpdraftCentral Fix Leaves A Gap In The Response To Stolen Keys

🔍 Read the full analysis: The UpdraftCentral Fix Leaves A Gap In The Response To Stolen Keys on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft has released UpdraftPlus 1.26.13 after attackers used stolen UpdraftCentral Cloud connection keys to install backdoor plugins on WordPress sites, but the update does not revoke every key potentially exposed in the breach. The company said attackers accessed its teamupdraft.com website over the weekend of October 17-18 and may have reached its customer database; security researchers say some keys require manual removal, and updating alone will not remove backdoors already installed.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, disclosed the breach on October 19. Its incident notice says the affected customer database contained names, email and billing addresses, order history, password hashes, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment-card details because Stripe and PayPal process payments. It also said backups sent directly to a customer’s own storage, such as Google Drive, Dropbox or Amazon S3, were not affected.

UpdraftCentral keys allow a connected WordPress site to accept signed management commands from the hosted dashboard. Patchstack’s analysis says attackers used the command plugin.upload_plugin to install and activate malicious plugins. Because the commands carried genuine signatures, Patchstack said the plugin’s normal checks passed; fully patched sites could be affected without a software vulnerability being exploited.

TeamUpdraft released versions 1.26.13 (free) and 2.26.13 (Premium) to revoke exposed keys. Nethemba’s review says the preceding 1.26.12 release did not delete keys because of a bug. The later release removes keys created before 12:07 UTC on October 18, according to the researchers. They say keys created between that time and 21:00 UTC are not removed by the update and must be deleted manually. TeamUpdraft’s stated cutoff was 22:00 British Summer Time, equivalent to 21:00 UTC.

Why Key Revocation Is Not Cleanup

The incident shows how a management credential can turn a trusted plugin feature into a route for remote site changes. UpdraftCentral’s purpose is to let users manage multiple WordPress installations from one dashboard; a valid key allows commands to be carried out with the permissions of the user who created it. In this case, that capability was reportedly used to install plugins, rather than attackers exploiting a flaw in the WordPress sites themselves.

The distinction matters for site owners: patching UpdraftPlus is not proof a site is clean. The update addresses key revocation only within its cutoff. A backdoor installed before revocation can remain on a site, along with an account created by that backdoor. Researchers warn that some malicious plugin variants hide themselves, and that removing the plugin may not remove the account or other access it created.

Exposure may also include keys that users did not realize they had created. TeamUpdraft’s UpdraftPlus settings have an option to add a site to UpdraftCentral that is ticked by default when connecting an account, according to the source material. Nethemba also reported that keys did not expire, and observed keys created in November 2025 being used after the breach. That finding suggests the potential exposure was not limited to recently created connections.

How the Dashboard Keys Worked

UpdraftPlus includes an UpdraftCentral client that remains inactive until a connection key is supplied. Once connected, it accepts commands signed by the dashboard key and acts with the permissions associated with the user who created it. This design supports centralized site management, but it also means a stolen key can carry authority beyond the dashboard account itself.

Nethemba said it found the attack on three of its own sites and attributed the activity to keys leaked from the UpdraftCentral Cloud environment. The firm said it ruled out a modified plugin, weak cryptography and the older forgery issue CVE-2026-10795, which was fixed in UpdraftPlus 1.26.5 in June. The source describes this as the second serious incident involving this channel in five months, though it does not provide further details about the earlier incident.

Patchstack counted 99 plugin names installed between the afternoon of October 18 and 09:23 UTC on October 19. Names included “Site Health Cache,” “Seo Helper,” “Wp Forge” and “Js Clean.” Patchstack identified a recurring description, “Small maintenance toolkit: keeps option storage tidy,” as a useful indicator. According to researchers, some versions create an account with elevated capabilities and use a persistent login cookie, while some hide from the plugin list.

““The commands are correctly encrypted and signed with genuine dashboard private keys.””

— Patchstack

Affected Accounts and Sites Uncounted

TeamUpdraft has not said how many customers or WordPress sites were affected, or how many stolen keys were used. The company said it believes attackers reached its customer database, but the available incident account does not establish the full extent of access or list all affected records and sites.

The exact status of individual keys depends on when they were created and whether a site was connected to UpdraftCentral. Nethemba’s findings identify a period of keys that the update does not remove automatically; site owners may not know the creation time of each key. The source also says cleanup guidance from the company and researchers is changing as additional backdoor variants are identified.

It is also not clear from the available material how many sites still contain malicious plugins or attacker-created accounts. A backdoor may be hidden, and an early variant reportedly caused HTTP 500 errors before checking its activation token. Nethemba and Patchstack warn against trying to repair that error: their advice is to remove the malicious plugin, while treating a site where one was found as compromised.

Owners Must Check Keys and Sites

TeamUpdraft said it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also reported the incident to the UK Information Commissioner’s Office. The company’s advisory and the researchers’ analyses remain the cited sources for current cleanup instructions.

Site owners should apply the current UpdraftPlus release, then check whether any UpdraftCentral keys fall within the period Nethemba says is not covered by automatic revocation and delete those keys manually. They should inspect sites for suspicious plugin names and descriptions, unexpected administrator or other privileged accounts, and signs of persistent access. If a backdoor is found, an update alone is insufficient; the site requires a full compromise response using current vendor and researcher guidance.

For sites that used UpdraftCentral to access external backup storage, TeamUpdraft recommends re-authorizing that storage and rotating its access keys. Further details from the company about the number of affected customers and sites, and updated cleanup guidance as researchers identify variants, would clarify the scope and remaining response steps.

Key Questions

What happened in the UpdraftCentral incident?

TeamUpdraft said attackers accessed its website and may have reached a customer database containing UpdraftCentral connection keys. Patchstack reported that attackers used stolen keys to send commands that installed and activated backdoor plugins on WordPress sites.

Does updating UpdraftPlus remove a backdoor?

No. The update is intended to revoke certain keys, not remove malicious plugins or accounts already created on a site. Sites where a backdoor is found need a separate cleanup and compromise response.

Which UpdraftPlus versions contain the key revocation fix?

TeamUpdraft released UpdraftPlus 1.26.13 for the free version and 2.26.13 for Premium. Nethemba says some keys created during the breach window still require manual deletion.

Were stored backups or payment-card details affected?

TeamUpdraft said backups stored in customers’ own services, including Google Drive, Dropbox and Amazon S3, were not affected. It said it did not store card data because Stripe and PayPal handle payments. The database reportedly included customer contact and order information, password hashes, two-factor settings and product connection keys.

How many customers or sites were affected?

TeamUpdraft has not disclosed a count of affected customers or sites. The company said it believes attackers reached the database, while researchers reported malicious plugin activity on observed sites; the total scope remains unknown.

Source: ThorstenMeyerAI.com