The UpdraftCentral Fix Has A Gap That Leaves WordPress Sites At Risk

🔍 Read the full analysis: The UpdraftCentral Fix Has A Gap That Leaves WordPress Sites At Risk on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on networking and server gear

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft said on October 19, 2026, that attackers accessed its website and may have reached a customer database containing UpdraftCentral Cloud connection keys; researchers report those keys were used to install backdoor plugins on WordPress sites. The company has released UpdraftPlus 1.26.13 to revoke some exposed keys, but updating does not remove a backdoor or attacker account already installed on a site.

In its incident post, TeamUpdraft said the attack took place over the weekend of October 17–18 and that it believes the attackers accessed its customer database. The company said the database included names, email addresses, billing addresses, order history, password hashes, two-factor authentication settings, and keys associated with UpdraftCentral, UpdraftVault and UpdraftClone. It said it did not store payment card details; Stripe and PayPal handled payments. TeamUpdraft has not disclosed how many customers or websites were affected.

TeamUpdraft says the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected. The risk concerns keys used by UpdraftCentral Cloud, a hosted dashboard for managing WordPress sites. Patchstack’s analysis says the attackers used legitimate signed commands to upload and activate plugins, rather than exploiting a vulnerability in the plugin. That meant sites running the latest UpdraftPlus version could still be affected if their connection keys were exposed.

TeamUpdraft first released version 1.26.12 on October 19, intending to revoke older cloud keys. Security firm Nethemba reported that a bug in that release meant it deleted no keys. Version 1.26.13 followed later that day. Nethemba’s code review says it removes keys created before 12:07 UTC on October 18, but leaves some keys created between 12:07 and 21:00 UTC that may require manual deletion. The vendor’s stated cutoff was 22:00 British Summer Time, equivalent to 21:00 UTC.

Why Exposed Keys Could Install Backdoors

The incident matters because the exposed credentials were not simply passwords to customer accounts. According to Patchstack, an UpdraftCentral key can authorize commands on a connected WordPress site, including a command to upload and activate a plugin. A valid command signed with a genuine dashboard key passes the plugin’s checks; according to the analysis, this attack did not require a software vulnerability or an outdated installation.

Patchstack counted 99 plugin names used in installations between the afternoon of October 18 and 09:23 on October 19. Names included “Site Health Cache,” “Seo Helper,” “Wp Forge” and “Js Clean.” One indicator researchers identified is the description, “Small maintenance toolkit: keeps option storage tidy.” These are findings from Patchstack’s analysis, not a count of confirmed infected sites.

Researchers say some backdoor variants can create an account with elevated capabilities and establish a persistent login that bypasses the usual login form. Removing the plugin alone may not remove the account. Some variants reportedly hide from the plugin list, while one early version could cause HTTP 500 errors before its token check. Nethemba and Patchstack warn against trying to repair that error: doing so could allow the backdoor to run. A site where a backdoor is found should be treated as compromised, not as cleaned by a plugin update.

How the Cloud Keys Reached Sites

UpdraftPlus includes a client for UpdraftCentral. It remains dormant until a site is connected with a key; after connection, the site can accept correctly signed commands from the dashboard. Nethemba reported finding the attack on three of its own sites and said the commands appeared to come from the attacker’s server using keys exposed from the UpdraftCentral Cloud environment. Nethemba said its investigation ruled out a modified plugin, weak cryptography and the older forgery issue CVE-2026-10795, which was fixed in version 1.26.5 in June.

Nethemba also reported two factors that can widen exposure: the option to add a website to remote UpdraftCentral control is ticked by default when connecting a TeamUpdraft account in UpdraftPlus settings, and keys do not expire. The firm said it observed keys created in November 2025 being used shortly after the breach. These findings help explain why site owners may have a connection they do not recall setting up, and why a key created months earlier could remain relevant.

TeamUpdraft says it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also said it reported the breach to the UK Information Commissioner’s Office. The company recommends reauthorizing storage connections and rotating access keys when UpdraftCentral was used to access a site. Its account of the incident and researchers’ technical findings describe different parts of the response and should be checked against their latest advisories.

““Properly apply the revocation in 1.26.12.””

— TeamUpdraft

How Many Sites Still Need Review

TeamUpdraft has not said how many customers or websites were affected, which accounts or keys were accessed, or how many sites received a backdoor. The company says it believes attackers reached the customer database; the extent of that access has not been publicly quantified in the supplied incident account.

The key-revocation cutoff also leaves site owners needing to establish when their connection was created. Nethemba says keys created during a specific window on October 18 are not removed by version 1.26.13, while TeamUpdraft’s stated cutoff is later than the timestamp Nethemba says the code applies. It is not clear from the available material whether TeamUpdraft has since provided a corrected account or an additional automated cleanup method. Connections made after the cutoff remain in place by design.

Researchers say backdoor variants differ, and cleanup guidance may change as additional versions are found. The available reports do not establish that every UpdraftPlus installation, every TeamUpdraft customer, or every site using the plugin was affected.

Update, Revoke and Check Each Site

Site owners should consult the current TeamUpdraft advisory and the latest Patchstack and Nethemba analyses, then update to UpdraftPlus 1.26.13 or the applicable current release. Updating is only one step: owners should check whether UpdraftCentral Cloud was connected, review the key’s creation time and manually remove a key if it falls into the window Nethemba identified. Where UpdraftCentral was used, TeamUpdraft recommends reauthorizing connected storage and rotating its access credentials.

Owners should also inspect for unfamiliar plugins and accounts, using researchers’ indicators as clues rather than as a complete detection list. If a suspicious plugin is found, follow current incident-response guidance and treat the site as compromised; do not assume that deleting the plugin or installing the update removes an account or other persistence. TeamUpdraft’s next public update, any further clarification of the revocation cutoff, and additional researcher findings will determine how much of the exposure can be addressed centrally and what site-by-site work remains.

Key Questions

Does installing UpdraftPlus 1.26.13 remove a backdoor?

No. The update is intended to revoke certain UpdraftCentral Cloud keys. It does not remove a backdoor plugin or an account already added to a WordPress site.

Were all UpdraftPlus users affected?

That has not been established. TeamUpdraft has not disclosed the number of affected customers or sites. Its statement says the plugin, downloads and self-hosted UpdraftCentral were not affected; the reported exposure concerns customer data and UpdraftCentral Cloud keys.

What information does TeamUpdraft say was in the database?

The company says it included contact and billing details, order history, password hashes, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft said it stored no payment card data.

What should I do if I find a suspicious plugin?

Follow the current guidance from TeamUpdraft and security researchers, and treat the site as compromised. Researchers warn that removing a backdoor plugin may not remove an account it created, and that repairing a crashing variant could allow it to execute.

Source: ThorstenMeyerAI.com