How WordPress Admins Can Respond To The UpdraftCentral Key Risk

🔍 Read the full analysis: How WordPress Admins Can Respond To The UpdraftCentral Key Risk on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft said on October 19, 2026, that attackers who accessed its website over the preceding weekend may have reached a customer database containing UpdraftCentral Cloud connection keys. Researchers reported that keys were used to send commands installing backdoor plugins on WordPress sites, including sites running current software versions. TeamUpdraft has released UpdraftPlus 1.26.13 to revoke some exposed keys, but updating alone does not remove an existing backdoor.

According to TeamUpdraft’s incident notice, the accessed database held customer names, email and billing addresses, order history, hashed account passwords, two-factor authentication settings, and keys used by UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment card details; Stripe and PayPal process payments. It also said backups stored by customers with services such as Google Drive, Dropbox or Amazon S3 were not affected. However, TeamUpdraft recommends re-authorising connected storage and rotating its access keys if UpdraftCentral was used to manage the site.

Security firms described the impact of the UpdraftCentral keys as a command-access problem, rather than a conventional plugin flaw. Patchstack said attackers issued a command to upload a plugin, which WordPress then installed and activated. Because the commands were signed with genuine dashboard keys, the plugin’s checks accepted them. No software vulnerability was needed, and patched sites could still be affected if they had a compromised connection key.

TeamUpdraft said it closed the access route, signed all accounts out, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also reported the incident to the UK Information Commissioner’s Office. The company released UpdraftPlus 1.26.12 on October 19, then issued version 1.26.13 after a problem prevented the earlier release from revoking keys as intended, according to the supplied incident reporting.

Why a dashboard key can compromise a site

An UpdraftCentral key allows a connected site to accept commands from the hosted dashboard. In practice, a stolen key can let an attacker use legitimate management functions to upload and activate a plugin. That can give an intruder a foothold even when WordPress and UpdraftPlus are up to date, making this incident different from an attack that depends on an unpatched software bug.

Researchers described backdoor plugins that can create an attacker-controlled account and provide a way to sign in without the normal login process. Patchstack counted 99 different plugin names installed during the reported attack period; the number is a count, not an estimate of affected sites. Some versions may hide from the plugin list, and removing the malicious plugin may not remove an account it created. Admins should treat evidence of a backdoor as a broader site compromise and check for persistence beyond the plugin itself.

The incident also shows why an update is only one part of response. The new release addresses some exposed keys, but a site may have been accessed before revocation, and not all keys within the stated exposure period are covered automatically. The number of affected customers and sites has not been disclosed.

How the key exposure reached WordPress

UpdraftPlus includes an UpdraftCentral client that remains inactive until a site is connected with a key. The source material says the connection option is selected by default when a TeamUpdraft account is connected in UpdraftPlus settings; Nethemba reported the same behavior in the Premium version. Administrators may therefore have created a connection without actively intending to use centralized management. The source also says these keys do not expire automatically.

Nethemba reported finding the attack on three of its own sites and attributed the activity to keys exposed from the UpdraftCentral Cloud environment. It said it ruled out a modified plugin, weak cryptography and the earlier forgery issue CVE-2026-10795, which had been fixed in June in UpdraftPlus 1.26.5. This is described in the source as the second serious incident involving this channel in five months; the supplied material does not provide further details about the earlier incident.

The key-revocation timeline needs careful attention. Nethemba’s review said version 1.26.13 deletes keys created before 12:07 UTC on October 18. It reported that keys created from 12:07 to 21:00 UTC that day are not automatically deleted, despite a TeamUpdraft cutoff stated as 22:00 BST, equivalent to 21:00 UTC. Those keys may require manual deletion. Administrators should consult the current vendor advisory and researcher analyses for the precise steps that apply to their setup.

“The commands are correctly encrypted and signed with genuine dashboard private keys.”

— Patchstack

What remains unknown about exposure

TeamUpdraft has not said how many customers or WordPress sites were affected, nor has the supplied information established how many backdoors remain active. It is also unclear which customers had keys created during the window that Nethemba says is not covered by automatic revocation. Administrators may need to determine when their connections were created before they can know whether manual key removal is required.

The backdoor activity has appeared under multiple plugin names, and researchers warn that variants differ. Some may hide themselves, while an early version reportedly caused HTTP 500 errors before its token check ran. Nethemba and Patchstack warn against trying to repair that broken version: doing so could allow the backdoor to run. Their guidance is to remove it and investigate the site. Cleanup instructions may change as further variants are identified.

Steps for administrators now

Admins using UpdraftPlus should first check that the free or Premium plugin is on version 1.26.13 and review TeamUpdraft’s latest incident advisory. They should confirm whether UpdraftCentral Cloud was connected, inspect the connection and key history if available, and manually remove any keys that fall within the uncovered October 18 window. The update does not clean a compromised site, so administrators should separately inspect installed plugins, unfamiliar accounts, user permissions and signs of unauthorized access.

If a suspicious plugin or account is found, admins should treat the site as compromised rather than assuming that deleting one plugin resolves the incident. Follow current guidance from TeamUpdraft, Patchstack and Nethemba, and consider involving a qualified incident-response provider. Rotate credentials and connected-storage access keys as appropriate, especially where UpdraftCentral was used to reach backup storage. Avoid relying on the absence of visible symptoms as proof that a site is clean.

The next milestones are further detail from TeamUpdraft about the investigation and affected accounts, and updated cleanup guidance from the company and researchers. Until those details are available, site owners should make decisions from the latest published advisories rather than assuming that plugin updating alone has closed every exposure.

Key Questions

Does updating UpdraftPlus remove a backdoor?

No. Version 1.26.13 revokes some exposed keys, according to the supplied reporting, but it does not remove a malicious plugin or an account that plugin created. Site inspection and cleanup are separate steps.

Which version should WordPress admins install?

The source material identifies UpdraftPlus 1.26.13 as the corrected release, available for both free and Premium editions. Check TeamUpdraft’s current advisory for any later updates or instructions.

Were customer backups or payment card numbers exposed?

TeamUpdraft said customer backups stored with services such as Google Drive, Dropbox and Amazon S3 were not affected, and that it did not store payment card details. It said Stripe and PayPal handle payments. If UpdraftCentral accessed a site, the company recommends re-authorising storage and rotating access keys.

How can an admin tell whether a site was compromised?

Check for unfamiliar plugins, unexpected user accounts or elevated permissions, and follow current indicators and cleanup guidance from TeamUpdraft and researchers. Some reported backdoors may hide themselves, so not seeing a suspicious plugin is not proof that a site was unaffected.

Source: ThorstenMeyerAI.com