Does The UpdraftCentral Fix Address The WordPress Backdoor Risk?

🔍 Read the full analysis: Does The UpdraftCentral Fix Address The WordPress Backdoor Risk? on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft says attackers who accessed its teamupdraft.com website over the October 17–18 weekend reached a customer database containing UpdraftCentral connection keys, then used stolen keys to install backdoor plugins on WordPress sites. The company released UpdraftPlus 1.26.13 to revoke some exposed keys, but the update does not remove backdoors already installed, and security researchers report that some keys from the incident window are not revoked automatically.

In an incident notice published October 19, TeamUpdraft said it believes attackers accessed its customer database. According to the company, the database included names, email addresses, billing addresses, order histories, hashed account passwords, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft said it did not store payment-card data; Stripe and PayPal process payments. It also said backups sent directly to a customer’s own storage, such as Google Drive, Dropbox or Amazon S3, were not affected.

UpdraftCentral Cloud lets customers manage multiple WordPress sites through a hosted dashboard. A connected site accepts commands authenticated with its connection key. Security firm Patchstack said it found attackers using the command plugin.upload_plugin to upload and activate plugins. Because the commands were signed with genuine dashboard keys, Patchstack said the attack did not require a software vulnerability, and fully patched sites could be affected.

TeamUpdraft released UpdraftPlus versions 1.26.13 (free) and 2.26.13 (Premium) after an earlier release, 1.26.12, failed to revoke keys, according to Nethemba’s code analysis. Nethemba reported that 1.26.13 removes keys created before 12:07 UTC on October 18, but does not automatically delete keys created between 12:07 and 21:00 UTC that day. TeamUpdraft’s stated cutoff was 22:00 British Summer Time, equivalent to 21:00 UTC. Nethemba says keys in that later part of the window must be deleted manually.

Why Key Revocation Is Only One Step

The incident shows how a legitimate remote-management feature can become a route into customer websites when its authentication keys are exposed. According to Patchstack, the attackers’ commands passed the plugin’s normal checks because they were signed with genuine keys. That means updating the plugin can close or limit access through affected keys, but it does not by itself establish whether a site was targeted or restore a site that has already been compromised.

For site owners, the distinction matters: key revocation is not backdoor removal. TeamUpdraft says the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected. However, sites connected to UpdraftCentral Cloud may have received malicious plugins. TeamUpdraft recommends re-authorizing external storage and rotating its access keys if UpdraftCentral was used to access the site. Owners also need to check for unauthorized plugins and accounts rather than treating a successful version update as proof that a site is clean.

The breadth of the incident remains unknown. TeamUpdraft has not said how many customers, keys or WordPress sites were affected. Patchstack counted 99 different plugin names in installations it observed between the afternoon of October 18 and 09:23 on October 19; that count describes observed names, not the total number of infected sites.

How the Dashboard Keys Worked

UpdraftPlus includes an UpdraftCentral client that remains inactive until a site is connected with a key. Once connected, the site can act on commands signed for that connection, with permissions associated with the user who created the key. TeamUpdraft said the breach affected the hosted dashboard’s customer data and keys, while the plugin and its downloads were not compromised.

Nethemba said it found the attack on three of its own sites and traced the commands to the attacker’s server. It reported that older keys could remain usable because they did not expire. The firm also ruled out, in its analysis, a modified plugin, weak cryptography and the earlier forgery issue CVE-2026-10795, which it said was fixed in UpdraftPlus 1.26.5 in June. The source material characterizes this as a second serious incident in the channel in five months.

Patchstack identified recurring plugin names including “Site Health Cache,” “Seo Helper,” “Wp Forge” and “Js Clean.” It said a more consistent clue was the description, “Small maintenance toolkit: keeps option storage tidy.” Some observed backdoors created accounts with names resembling “data-ops43” and granted them additional capabilities. Researchers warn that removing a malicious plugin may not remove the account it created, and some variants may hide from the plugin list.

““Properly apply the revocation in 1.26.12.””

— TeamUpdraft, in its incident notice

Affected Sites and Keys Remain Unknown

TeamUpdraft has not disclosed how many customers or WordPress sites were affected, or how many exposed keys attackers obtained or used. The company’s investigation is ongoing, and the source material does not provide an independent count of compromised sites.

It is also not clear from the available information which individual customers’ keys fell within the period that Nethemba says is not covered by automatic revocation. Keys created after the cutoff are left intact by design, while some keys created during the reported breach window may require manual deletion. Owners may not know a key exists: the option to add a site to UpdraftCentral is ticked by default when connecting a TeamUpdraft account in UpdraftPlus settings, according to the source material.

Researchers describe backdoor variants with different behavior. One early version reportedly caused HTTP 500 errors before checking for its activation token; Nethemba and Patchstack warn against trying to repair that plugin because doing so could activate the backdoor. Cleanup instructions may change as further variants are identified. The available material does not establish that every site connected to UpdraftCentral Cloud was targeted.

What Site Owners Should Check

TeamUpdraft says it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also reported the incident to the UK Information Commissioner’s Office. Site owners should follow the latest versions of the company’s advisory and the Patchstack and Nethemba analyses, rather than relying only on an update notice.

Owners who used UpdraftCentral Cloud should install the appropriate patched UpdraftPlus version, check whether any affected connection keys remain and delete keys manually where required. They should inspect plugins and user accounts for unauthorized additions. If a suspicious plugin is found, researchers advise removing it rather than attempting to fix a broken version; removing the plugin alone may not remove accounts it created. TeamUpdraft also recommends re-authorizing external storage and rotating access keys if UpdraftCentral was used to access that storage.

The next confirmed milestones are further investigation and updated cleanup guidance from TeamUpdraft and security researchers. Until the company publishes a fuller account of the affected customers and sites, the scope of the breach remains undetermined; a software update should be treated as one response step, not confirmation that a site is uncompromised.

Key Questions

Does UpdraftPlus 1.26.13 remove a backdoor from a WordPress site?

No. The update is intended to revoke certain UpdraftCentral keys. It does not remove a backdoor plugin or an unauthorized account that may already have been created on a site.

Which versions did TeamUpdraft release?

TeamUpdraft released UpdraftPlus 1.26.13 for the free version and 2.26.13 for Premium. The source material says the earlier 1.26.12 release did not revoke keys as intended.

Were all exposed UpdraftCentral keys revoked automatically?

Not according to Nethemba’s analysis. It reported that version 1.26.13 removes keys created before 12:07 UTC on October 18, but keys created from 12:07 to 21:00 UTC that day require manual deletion. The exact keys held by individual customers are not identified in the available information.

What information did TeamUpdraft say was exposed?

The company said the database contained names, email addresses, billing addresses, order histories, hashed passwords, two-factor authentication settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. It said it did not store card data and that direct-to-customer backup storage was not affected.

How many sites were affected?

The number has not been disclosed. TeamUpdraft has not said how many customers or sites were affected. Patchstack reported 99 different plugin names in observed installations during a specified period, but that figure is not a count of affected sites.

Source: ThorstenMeyerAI.com