Why The UpdraftCentral Key Fix May Leave WordPress Sites Exposed

🔍 Read the full analysis: Why The UpdraftCentral Key Fix May Leave WordPress Sites Exposed on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft has released an UpdraftPlus security update after attackers used stolen UpdraftCentral connection keys to install backdoor plugins on WordPress sites, but researchers say the fix does not revoke every exposed key or remove backdoors already in place. The company confirmed on October 19, 2026, that intruders accessed its website and likely reached a customer database containing the keys used by its cloud dashboard to manage connected sites.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said attackers accessed the teamupdraft.com website over the weekend of October 17–18 and likely reached a database containing customer names, email and billing addresses, order histories, hashed account passwords, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said payment card details were not stored in the database because Stripe and PayPal process payments. It also said backups stored with services such as Google Drive, Dropbox or Amazon S3 were not affected.

TeamUpdraft released UpdraftPlus versions 1.26.13 (free) and 2.26.13 (Premium) to revoke exposed UpdraftCentral keys. Security firm Nethemba said its review found the corrected update deletes keys created before 12:07 UTC on October 18. However, keys created between 12:07 and 21:00 UTC that day are not removed automatically, according to Nethemba. The company’s stated cutoff was 22:00 British Summer Time, equivalent to 21:00 UTC.

Updating the plugin also does not clean an infected site. Researchers at Patchstack identified a command that uploaded and activated a plugin, while their analysis counted 99 different plugin names used in installations between the afternoon of October 18 and 09:23 UTC on October 19. Some discovered backdoors create privileged accounts that persist after the plugin is deleted. TeamUpdraft has not disclosed how many customers or sites were affected.

Why Key Revocation Falls Short

The exposed keys matter because an UpdraftCentral-connected WordPress site accepts commands signed with its key. According to Patchstack, attackers used the legitimate command mechanism to upload and activate plugins; the commands passed the plugin’s checks because they were signed with genuine dashboard keys. This means that, in the reported attacks, a newly discovered flaw in the site’s WordPress software was not required. Fully patched sites could still be affected if they had a compromised connection key.

The update addresses only part of the problem. A key that was not automatically revoked may still need to be removed manually, and a site that has already received a backdoor needs separate investigation and cleanup. Researchers describe backdoor variants that can create an account with elevated capabilities and log in through a persistent cookie. Removing the plugin alone may leave the account behind. An early variant also caused server errors; Nethemba and Patchstack warn that attempting to repair that broken plugin could allow its backdoor code to run.

For site owners, this turns a vendor update into a broader incident-response task: check whether the site was connected to UpdraftCentral, establish whether a suspicious plugin or account appeared, and follow current guidance for revoking keys and cleaning affected systems. If UpdraftCentral was used to access a site, TeamUpdraft recommends re-authorising connected storage and rotating its access keys.

How the Dashboard Keys Work

UpdraftPlus includes an UpdraftCentral client that remains inactive until a connection key is supplied. Once connected, the site can accept commands from the hosted UpdraftCentral dashboard. The intended use is remote management of multiple WordPress sites from one place. According to the source report, the account-connection option to add a site to UpdraftCentral is checked by default, so a site owner may have enabled the connection without noticing it.

Nethemba said it found the attack on three of its own sites and concluded that the keys came from the UpdraftCentral Cloud environment and were used from an attacker-controlled server. It said keys created as early as November 2025 were used after the breach, indicating that at least some keys did not expire automatically. Nethemba also said its analysis ruled out a modified plugin, weak cryptography and the older key-forgery vulnerability CVE-2026-10795, which it said was fixed in version 1.26.5 in June.

The first attempted fix, UpdraftPlus 1.26.12, was released on October 19. Nethemba reported that a bug meant it did not delete any keys. Version 1.26.13 followed that evening with a changelog note saying it properly applied the revocation. That sequence explains why researchers advise checking both the installed version and the creation time of any relevant key, rather than assuming the initial update removed all exposure.

“The company said it believes attackers reached its customer database.”

— TeamUpdraft

The Uncounted Exposure Window

The number of affected customers and WordPress sites remains unknown. TeamUpdraft has not said how many records or connection keys were accessed, how many keys were used to install backdoors, or how many sites remain compromised. Nethemba’s report concerns its own three sites and technical analysis; it does not establish the total scope of the incident.

It is also not clear from the available information which customers had active UpdraftCentral connections, whether all keys in the stated time window were obtained or used, or how many backdoor variants remain undiscovered. The source report says cleanup guidance was changing as researchers found variants. No final account of the breach’s entry point or a complete forensic timeline was provided.

Next Steps for Site Owners

TeamUpdraft said it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys, rotated keys with payment providers and reported the incident to the UK Information Commissioner’s Office. It has not announced a public figure for affected customers or sites. Site owners should consult the latest TeamUpdraft advisory alongside the current analyses from Patchstack and Nethemba, since reported cleanup guidance may change.

Owners using UpdraftPlus should update to the applicable patched version, then check whether an UpdraftCentral connection was enabled and determine when its key was created. Keys in the uncovered time window may require manual revocation. Sites with suspicious plugins, unexpected privileged accounts or other indicators of compromise need investigation beyond the plugin update; a backdoor’s removal may not remove accounts it created. The scope and final remediation status remain developing.

Key Questions

Does updating UpdraftPlus remove an installed backdoor?

No. The update revokes some UpdraftCentral keys, but researchers say it does not remove a backdoor plugin or an account that the backdoor may have created. Affected sites need separate investigation and cleanup.

Which UpdraftPlus versions contain the key-revocation fix?

TeamUpdraft released version 1.26.13 for the free plugin and 2.26.13 for Premium. The source report says version 1.26.12 did not delete keys because of a bug.

Are all exposed keys revoked by version 1.26.13?

Not according to Nethemba. It reported that the update removes keys created before 12:07 UTC on October 18, but not keys created from then until 21:00 UTC that day. Those may need manual removal.

Were backups stored with Google Drive or Amazon S3 affected?

TeamUpdraft said backups stored in customers’ own services, including Google Drive, Dropbox and Amazon S3, were not affected. For sites accessed through UpdraftCentral, the company recommends re-authorising storage and rotating access keys.

How many sites were compromised?

The total is not known. TeamUpdraft has not disclosed the number of affected customers or sites. Patchstack counted 99 different plugin names in reported installations during a specified period, but that figure is not a count of confirmed compromised sites.

Source: ThorstenMeyerAI.com