🔍 Read the full analysis: Why The UpdraftCentral Key Fix May Not Fully Protect WordPress Sites on ThorstenMeyerAI.com
Get business pricing on networking and server gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
TeamUpdraft confirmed that attackers accessed its website and likely reached a customer database containing UpdraftCentral connection keys. Its UpdraftPlus 1.26.13 update revokes some exposed keys, but security researchers report that keys created during part of the breach window may remain active, and the update does not remove backdoors or rogue accounts already installed on sites.
TeamUpdraft says attackers who accessed its website over the weekend of October 17–18, 2026, likely reached a customer database containing keys used to control WordPress sites through UpdraftCentral Cloud. The company released UpdraftPlus 1.26.13 to revoke exposed keys, but researchers say the update may leave some keys untouched and does not remove backdoors already installed on affected sites.
In its October 19 incident post, TeamUpdraft said the database held customer names, email and billing addresses, order history, hashed account passwords, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said payment card information was not stored in the database; payments are handled by Stripe and PayPal. It also said backups stored with services such as Google Drive, Dropbox or Amazon S3 were not affected.
TeamUpdraft said it closed the access route, signed out accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It reported the incident to the UK Information Commissioner’s Office. The company has not disclosed how many customers or WordPress sites may be affected. It said UpdraftPlus itself, its downloads and self-hosted UpdraftCentral were not affected.
Security firms Patchstack and Nethemba said attackers used genuine UpdraftCentral keys to send commands that uploaded and activated plugins. Patchstack counted 99 different plugin names used between the afternoon of October 18 and 09:23 UTC on October 19. One recurring description was “Small maintenance toolkit: keeps option storage tidy.” The malicious plugins could create administrator-like accounts and enable persistent access, according to the researchers.
Infographic 01 · UpdraftCentral key compromise
Stolen keys, signed commands, backdoored sites.
Keys leaked from TeamUpdraft's customer database let attackers send valid commands to connected WordPress sites. No plugin vulnerability was needed.
Timeline
Times as reported by the named source.
- 17 Oct, evening · Attacker has access to teamupdraft.com (Nethemba)
- 18 Oct, afternoon · First backdoor plugin installed via a signed UpdraftCentral command (Patchstack)
- 19 Oct, 09:23 · Latest backdoor install seen; 99 plugin names in total (Patchstack)
- 19 Oct, 13:00 UTC · TeamUpdraft publishes its incident advisory (Patchstack)
- 19 Oct · UpdraftPlus 1.26.12: key revocation ships, but a bug deletes no key (Nethemba)
- 19 Oct, evening · 1.26.13 fixes it; keys made 18 Oct 12:07–21:00 UTC still remain (Nethemba)
Patchstack and Nethemba analyses are being updated as new variants appear.
What the update does, and doesn’t
Based on Nethemba’s code review and TeamUpdraft’s advisory.
- 1
1.26.12 / 2.26.12
Meant to revoke the stolen keys. Because of a bug, it deleted none (Nethemba).
- 2
1.26.13 / 2.26.13
Revokes UpdraftCentral Cloud keys created before 12:07 UTC on 18 Oct.
- 3
Gap: 18 Oct, 12:07–21:00 UTC
Keys created in this window are not revoked, although the vendor's cutoff is 21:00 UTC.
- 4
Backdoors stay
Revoking a key does not remove an installed backdoor plugin or the account it created.
- 5
Guidance still changing
New backdoor variants keep turning up; vendor and researcher advisories are being updated.
Sources: TeamUpdraft (19 Oct 2026); Patchstack; Nethemba (updated 20 Oct 2026).
Powered by Thorsten Meyer AI
Why Key Revocation Is Not Cleanup
The incident shows how a legitimate remote-management feature can become a route into connected sites when its control keys are exposed. According to Patchstack, an attacker with a valid key could send a signed command to install a plugin; the command passed the plugin’s checks because it used genuine dashboard credentials. Researchers said this did not require a flaw in the current UpdraftPlus code, so simply running the latest version would not have prevented a command signed with a stolen key.
For site owners, there are two distinct tasks: revoke exposed access and inspect or clean sites where a malicious plugin may already have run. Updating UpdraftPlus addresses part of the first task, but does not remove an installed backdoor or an account it created. Some backdoor variants reportedly hide from the plugin list, and Nethemba and Patchstack warned against trying to repair one variant that causes HTTP 500 errors: changing it could allow its backdoor behavior to run.
The exposure may also include site owners who did not knowingly use the cloud dashboard. The source reports that connecting a TeamUpdraft account in UpdraftPlus settings enables the option to add the site to UpdraftCentral by default. Nethemba also reported that keys did not expire, and said it saw keys created in November 2025 used after the breach. These details make it harder for owners to infer exposure from recent activity alone.
Products Worth Considering
LG UltraGear 25G590B-B 25-Inch Full HD 1000Hz Gaming Monitor
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, IPX4, Black
Samsung Galaxy Tab A11+ 8GB RAM, 256GB Storage, Gray
As an affiliate, we earn on qualifying purchases.
How the UpdraftCentral Keys Worked
UpdraftPlus includes a client for UpdraftCentral that remains dormant until it receives a connection key. Once connected, the site accepts commands signed with that key, operating with the permissions of the user who created it. The feature is designed to let site owners manage multiple WordPress installations from a central dashboard; in this incident, researchers said the stolen credentials let attackers use the same mechanism to install plugins remotely.
TeamUpdraft initially issued UpdraftPlus 1.26.12 on October 19, intending to revoke keys created before the incident. Nethemba said a bug meant that version deleted no keys. TeamUpdraft released versions 1.26.13 (free) and 2.26.13 (Premium) later that day. Nethemba’s code review said the corrected revocation removes keys created before 12:07 UTC on October 18. The supplied account says keys created from 12:07 to 21:00 UTC that day are not removed automatically, despite TeamUpdraft’s stated cutoff of 22:00 British Summer Time, equivalent to 21:00 UTC.
Nethemba said it found the attack on three of its own sites and traced the activity to keys leaked from the UpdraftCentral Cloud environment. The firm said its analysis did not point to a modified plugin, weak cryptography or the older key-forgery vulnerability CVE-2026-10795, which was fixed in June in UpdraftPlus 1.26.5. That distinction matters: the reported route was abuse of legitimate keys, rather than exploitation of that earlier vulnerability.
“The commands are correctly encrypted and signed with genuine dashboard private keys.”
— Patchstack
Exposure Counts and Cleanup Remain Open
TeamUpdraft has not said how many customers, connection keys or WordPress sites were affected, and the source material does not establish how many sites received a backdoor. It is also not clear whether every exposed key was used or whether additional malicious plugin variants remain to be identified.
The reported revocation window needs careful handling. Nethemba said keys created between 12:07 and 21:00 UTC on October 18 were not deleted by 1.26.13 and would need manual removal; TeamUpdraft’s stated cutoff was 21:00 UTC. The available material does not explain how owners can reliably identify the creation time of every key or confirm that a manual removal was successful. Researchers and the vendor were still updating cleanup guidance as new variants appeared.
TeamUpdraft’s statement that backups in owners’ own cloud storage were unaffected does not settle whether credentials used to connect that storage need attention. The company recommends re-authorizing storage and rotating access keys if UpdraftCentral was used to access a site. Site owners should follow the latest vendor and researcher instructions rather than assume that installing the update alone establishes that a site is clean.
Owners Need to Check Keys and Sites
Site owners using UpdraftPlus should install the applicable fixed release, 1.26.13 free or 2.26.13 Premium, and consult the current TeamUpdraft advisory alongside Patchstack’s and Nethemba’s analyses. They should check whether UpdraftCentral Cloud was connected, review the key-revocation window, and manually remove keys that researchers say fall within the uncovered interval. If UpdraftCentral was used to reach a site, TeamUpdraft recommends re-authorizing connected storage and rotating its access credentials.
Where a suspicious plugin or account is found, the update should not be treated as a complete response. The researchers’ guidance, as described in the source material, is to remove the malicious plugin rather than repair the crashing variant, and to treat a site where a backdoor was found as compromised. The precise cleanup process may change as investigators identify variants, so site owners should check for revised instructions before considering remediation complete.
TeamUpdraft has said it reported the breach to the UK Information Commissioner’s Office. The next key developments are any further company disclosures about affected customers and sites, updated guidance on key removal and backdoor cleanup, and confirmation of whether the exposed-key window or the set of malicious variants has changed.
Key Questions
Does installing UpdraftPlus 1.26.13 remove a backdoor?
No. The update is intended to revoke certain exposed connection keys. The source material says it does not remove a malicious plugin or an account already created on a WordPress site.
Which UpdraftPlus versions did TeamUpdraft release?
TeamUpdraft released 1.26.13 for the free edition and 2.26.13 for Premium after issuing 1.26.12, which Nethemba said failed to delete keys because of a bug.
Were payment card details or stored backups exposed?
TeamUpdraft said card data was not held in the affected database because Stripe and PayPal process payments. It also said backups stored in customers’ own services, including Google Drive, Dropbox and Amazon S3, were not affected.
Could a site be exposed if its owner did not knowingly use UpdraftCentral?
Possibly. The source reports that the option to add a site to UpdraftCentral Cloud is ticked by default when a TeamUpdraft account is connected in UpdraftPlus settings. Owners should check whether a connection key was created rather than rely on memory of using the dashboard.
How many sites were affected?
TeamUpdraft has not disclosed a total. Patchstack counted 99 different malicious plugin names during a stated period, but that figure is not a count of affected sites or customers.
Source: ThorstenMeyerAI.com
