A Fix Is Available, But The UpdraftCentral Key Gap Leaves Questions

🔍 Read the full analysis: A Fix Is Available, But The UpdraftCentral Key Gap Leaves Questions on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get hardware and tech essentials delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft says attackers who accessed its website over the weekend of October 17-18 likely reached a customer database containing UpdraftCentral Cloud connection keys, which were then used to install backdoor plugins on WordPress sites. The company has released UpdraftPlus 1.26.13 to revoke affected keys, but security researchers say the revocation has limits, and updating alone does not remove an installed backdoor.

In its October 19 incident post, TeamUpdraft, the company behind the UpdraftPlus backup plugin, said it had closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. The customer database may have included names, email and billing addresses, order histories, password hashes, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment-card data; Stripe and PayPal process payments.

TeamUpdraft said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected. The risk centers on UpdraftCentral Cloud, a hosted dashboard for managing multiple WordPress sites. According to security firm Patchstack, attackers used genuine dashboard keys to send a command to upload and activate a plugin. Because the command was properly signed, affected sites could accept it without a software vulnerability; Patchstack said even fully updated sites were exposed if they had a compromised key.

TeamUpdraft first released UpdraftPlus 1.26.12 on October 19, intending to revoke keys created before the incident. Nethemba, a security firm that examined the code, said a bug meant that release deleted no keys. The company issued versions 1.26.13 (free) and 2.26.13 (Premium) later that day. Nethemba reported that the corrected release removes keys created before 12:07 UTC on October 18. It said keys created between 12:07 and 21:00 UTC that day were not deleted by the update and must be removed manually.

Why a Dashboard Key Can Install Backdoors

The incident matters because a connection key can give a remote dashboard authority to issue commands on a connected site. Patchstack said the attacker’s signed command uploaded and activated plugins, turning a management feature into a route for placing persistent access. A site did not need to be running an outdated version for that command to work if its key had been exposed.

Patchstack counted 99 different plugin names installed between the afternoon of October 18 and 09:23 on October 19. The count is a number of observed names, not a count of affected sites or customers. One recurring description was “Small maintenance toolkit: keeps option storage tidy.” Researchers said some backdoor variants create an administrator-like account, maintain access with a persistent cookie and may hide from the plugin list. Removing the plugin update alone does not undo those actions.

The exposure may also reach site owners who do not recall enabling remote management. The option to add a site to UpdraftCentral when connecting a TeamUpdraft account is ticked by default, according to the source material. Nethemba also reported that keys do not expire automatically and observed keys created in November 2025 being used after the breach. These details make it harder to assume a site is unaffected simply because its owner did not recently use the dashboard.

How the UpdraftCentral Connection Works

UpdraftPlus includes an UpdraftCentral client that remains dormant until a connection key is supplied. Once connected, the site accepts commands signed with the relevant key and executes them with the permissions of the user who created it. That design supports remote site management, but it also means an exposed key can authorize commands without exploiting a separate plugin flaw.

Nethemba said it found the attack on three of its own sites and traced the activity to keys leaked from the UpdraftCentral Cloud environment, used from an attacker-controlled server. The firm said it ruled out a modified plugin, weak cryptography and the earlier forgery issue CVE-2026-10795, which it said was fixed in version 1.26.5 in June. The source describes this as the second serious incident involving this channel in five months, but does not provide further details about the earlier incident.

TeamUpdraft said backups stored in users’ own destinations, including Google Drive, Dropbox and Amazon S3, were not affected. However, it recommends re-authorizing storage and rotating access keys if UpdraftCentral was used to access a site. That advice reflects the difference between the backup files themselves and credentials that may have been used to reach connected services.

““The commands are correctly encrypted and signed with genuine dashboard private keys.””

— Patchstack

Which Sites Still Need Key Removal

TeamUpdraft has not said how many customers or WordPress sites were affected, or confirmed the full number of records accessed. The company believes attackers reached the customer database, while the precise scope of the exposure remains unreported in the source material. It has reported the incident to the UK Information Commissioner’s Office.

The key-revocation boundary is also not complete for every connection. Nethemba said version 1.26.13 deletes keys created before 12:07 UTC on October 18, while keys created from then until 21:00 UTC were left in place and require manual deletion. TeamUpdraft’s stated cutoff was 22:00 BST, equivalent to 21:00 UTC. Connections created after the cutoff are not revoked, by design, so site owners may need to establish when their keys were made.

It is not yet clear how many sites have an installed backdoor or whether every variant has been identified. Researchers said the backdoor can leave accounts behind after its plugin is removed, and some variants may be concealed. Cleanup guidance is still being updated as researchers find variants, so the full remediation picture may change.

Key Checks and Site Cleanup

TeamUpdraft’s advisory and the Patchstack and Nethemba analyses remain the cited sources for current remediation instructions. Site owners using UpdraftPlus should check the current vendor guidance, update to the applicable release, and determine whether any UpdraftCentral connection keys fall into the period Nethemba said requires manual deletion. Owners should also re-authorize storage and rotate access keys if they used UpdraftCentral to access their sites, in line with the vendor’s advice.

Where a suspicious plugin or account is found, the update should not be treated as a complete cleanup. Researchers warn that the backdoor and the account it created can remain after key revocation, and that a broken plugin variant should be removed rather than repaired because repairing it may activate its code. The available source does not provide a final count of affected sites or a completed investigation timeline; further vendor and researcher updates are needed to clarify both.

Key Questions

Does updating UpdraftPlus remove an installed backdoor?

No. The update revokes some connection keys, but TeamUpdraft and researchers’ findings described here do not indicate that it removes a backdoor plugin or accounts already created on a site. Those require separate investigation and cleanup.

Which UpdraftPlus versions contain the corrected key revocation?

TeamUpdraft released version 1.26.13 for the free plugin and 2.26.13 for Premium. Nethemba said the earlier 1.26.12 release failed to delete keys because of a bug.

Are all UpdraftCentral keys revoked by the update?

No. Nethemba reported that version 1.26.13 deletes keys created before 12:07 UTC on October 18, 2026, but keys created between 12:07 and 21:00 UTC that day need manual deletion. Connections made after the stated cutoff are not automatically revoked.

Were backup files in Google Drive or Dropbox taken?

TeamUpdraft said backups stored in users’ own services, including Google Drive, Dropbox and Amazon S3, were not affected. It recommends re-authorizing storage and rotating access keys if UpdraftCentral was used to access a site.

How many sites or customers were affected?

TeamUpdraft has not disclosed a total number of affected customers or sites in the source material. Patchstack’s count of 99 refers to different plugin names observed during the attack window, not the number of compromised websites.

Source: ThorstenMeyerAI.com