What’s Behind The WordPress Backdoor Reports Tied To UpdraftCentral Keys?

🔍 Read the full analysis: What’s Behind The WordPress Backdoor Reports Tied To UpdraftCentral Keys? on ThorstenMeyerAI.com

TeamUpdraft confirmed on October 19 that attackers accessed its website and likely reached a customer database containing keys used to control connected WordPress sites through UpdraftCentral Cloud. Security researchers say those keys were used to install backdoor plugins, including on sites running current software versions, making the incident more than a routine plugin-update issue.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said the attackers accessed teamupdraft.com during the weekend of October 17–18 and that its investigation indicates the customer database was reached. The company said the database held names, email and billing addresses, order history, hashed account passwords, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. It said it did not store payment-card data; Stripe and PayPal handle payments. Backups stored by customers in services such as Google Drive, Dropbox or Amazon S3 were not affected, according to the company.

Researchers at Patchstack said attackers used the keys to send a signed command to upload and activate plugins. Because the commands were authenticated with genuine dashboard keys, the UpdraftPlus client treated them as authorized; the researchers said exploiting a software vulnerability was not required. Patchstack counted 99 plugin names installed from the afternoon of October 18 to 09:23 on October 19. That is a count of different names in the observed activity, not a confirmed count of affected sites.

TeamUpdraft released UpdraftPlus 1.26.13 and 2.26.13, for the free and Premium versions, to address key revocation after an earlier release did not apply the intended revocation, according to Nethemba’s code analysis. Nethemba reported that the newer release deletes keys created before 12:07 UTC on October 18, while keys created from 12:07 to 21:00 UTC that day may require manual removal. TeamUpdraft’s stated cutoff was 22:00 British Summer Time, equivalent to 21:00 UTC. Updating does not remove an already installed backdoor or its user account.

Why a Dashboard Key Could Install Backdoors

The incident shows how a legitimate remote-management connection can become a route into a site when its authorization keys are exposed. UpdraftPlus includes an UpdraftCentral client that can remain inactive until connected; once a key is set, the site accepts properly signed commands with the permissions granted when the connection was created. Researchers said the malicious plugin uploads passed those checks because they carried genuine dashboard signatures.

For site owners, the practical impact is that being fully patched may not be enough if a site had a compromised connection key. A site may also have been connected without its owner recalling it: the option to add a site to UpdraftCentral is ticked by default when connecting a TeamUpdraft account, according to the source material. Researchers also said keys do not expire, and Nethemba observed keys created in November 2025 used after the breach. The exposure therefore may reach beyond recently created connections.

A backdoor can create an administrator-like account and preserve access even after the plugin is deleted. The described variants create accounts with additional capabilities and use a persistent login cookie; some conceal themselves from the plugin list. That makes incident response and a careful site inspection necessary, rather than treating the software update as a complete repair.

How the UpdraftCentral Connection Works

UpdraftCentral Cloud is a hosted dashboard for managing multiple WordPress sites. The UpdraftPlus plugin contains a client that can receive commands from that service once a site has been connected with a key. TeamUpdraft said the UpdraftPlus plugin itself, its download service and self-hosted UpdraftCentral were not affected by the breach; the reported exposure concerns keys in the company’s customer database for its hosted service.

Patchstack reported that a commonly seen plugin description was “Small maintenance toolkit: keeps option storage tidy.” The source material says the backdoor can wait for a URL parameter containing a 32-character token, create an account often named with labels such as “data-ops” or “media-staff,” and retain access through a cookie. Those details are indicators researchers described, not a complete list of every variant. Nethemba said it found the activity on three of its own sites and ruled out a modified plugin, weak cryptography and the earlier forgery vulnerability CVE-2026-10795, which it said had been fixed in June in version 1.26.5.

TeamUpdraft said it closed the access route, signed out accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also reported the incident to the UK Information Commissioner’s Office. The company said customer backups in external storage were not affected, but recommended that customers who used UpdraftCentral to access sites re-authorize that storage and rotate its access keys.

“The commands are correctly encrypted and signed with genuine dashboard private keys.”

— Patchstack

How Many Sites Still Need Review

The number of affected customers and WordPress sites is not known. TeamUpdraft had not disclosed those figures in the supplied incident account. It is also unclear how many customers had active or dormant UpdraftCentral keys, how many exposed keys were used, and how many sites received a backdoor.

The extent of remaining key exposure also depends on when individual keys were created and whether they fall within the manual-removal interval reported by Nethemba. The incident response and researcher guidance may change as additional backdoor variants are identified. An updated plugin alone cannot establish whether a site was compromised, and the source material does not provide a definitive method for confirming that every affected site has been cleaned.

Key Revocation and Site Checks

TeamUpdraft customers should consult the latest company advisory and the current analyses from Patchstack and Nethemba, as cleanup guidance may change. Site owners should install the relevant UpdraftPlus update, check whether a site was connected to UpdraftCentral, and determine whether its key falls in the interval that may need manual removal. Those who used UpdraftCentral to access a site should follow TeamUpdraft’s advice to re-authorize external storage and rotate its access keys.

If a backdoor or suspicious account is found, removing the UpdraftPlus plugin or applying an update is not enough: the reported backdoor and account can persist independently. Researchers warned that some early variants cause HTTP 500 errors before their activation check; their advice is to remove the affected malicious plugin rather than repair it, because restoring normal requests could activate the backdoor. TeamUpdraft’s investigation, the scale of the breach and further cleanup instructions remain the next developments to watch.

Key Questions

What was exposed in the TeamUpdraft breach?

TeamUpdraft said attackers likely reached a customer database containing contact and billing details, order history, hashed passwords, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment-card information and that backups in customers’ own external storage were not affected.

Can an updated UpdraftPlus installation still be compromised?

Researchers said exposed, valid UpdraftCentral keys could authorize plugin-installation commands even on fully patched sites. Updating is needed to address key revocation, but an update does not remove a backdoor that was already installed.

Does UpdraftPlus 1.26.13 remove every exposed key?

Not according to Nethemba’s analysis. It reported that version 1.26.13 deletes keys created before 12:07 UTC on October 18, 2026, while keys created between then and 21:00 UTC may require manual removal. Site owners should check current TeamUpdraft guidance for their situation.

How can a site owner tell whether a backdoor was installed?

Researchers described suspicious plugin names and a recurring description, as well as unexpected accounts with elevated capabilities. Those are indicators, not a complete test: variants differ, and the number of affected sites has not been disclosed. A site where a backdoor is found requires cleanup beyond updating UpdraftPlus.

Source: ThorstenMeyerAI.com