Why A Fix With A Gap Matters For WordPress Sites Using UpdraftCentral

🔍 Read the full analysis: Why A Fix With A Gap Matters For WordPress Sites Using UpdraftCentral on ThorstenMeyerAI.com

TeamUpdraft said on October 19, 2026, that attackers had accessed its website and likely reached a customer database containing UpdraftCentral Cloud connection keys, which can authorize commands on linked WordPress sites. The company released UpdraftPlus updates to revoke compromised keys after attackers had used them to install backdoor plugins, but security firm Nethemba says the fix leaves some keys untouched, and an update alone does not remove an installed backdoor.

In its incident post, TeamUpdraft said the intrusion took place over the weekend of October 17–18, targeting teamupdraft.com. The company believes the attackers accessed customer information including names, email and billing addresses, order history, hashed passwords, two-factor authentication settings, and keys associated with UpdraftCentral, UpdraftVault and UpdraftClone. It said payment card data was not stored in the affected database because Stripe and PayPal process payments. The company has not reported how many customers or sites were affected.

TeamUpdraft released UpdraftPlus 1.26.12 on October 19, intending to revoke old UpdraftCentral Cloud keys. Nethemba’s review found that version did not delete the keys. TeamUpdraft then issued free version 1.26.13 and Premium version 2.26.13; Nethemba says the corrected revocation removes keys created before 12:07 UTC on October 18. It says keys made between 12:07 and 21:00 UTC that day remain and must be deleted manually. That cutoff differs from TeamUpdraft’s stated 22:00 BST cutoff, equivalent to 21:00 UTC.

Researchers at Patchstack analyzed the attack and reported that attackers used signed commands to upload and activate plugins. Patchstack counted 99 plugin names installed between October 18 and 09:23 on October 19. A recurring description was “Small maintenance toolkit: keeps option storage tidy.” Nethemba said it found the attack on three of its own sites. The researchers’ findings indicate that a valid stolen key could authorize the action without exploiting a software flaw in the plugin.

Why Revoking Keys Is Not Cleanup

The incident shows why a security update and a full incident response are different tasks. Revoking a compromised key can stop future commands signed with that key, but it does not undo a plugin installation or remove an account an attacker created. TeamUpdraft’s update therefore cannot by itself establish that a connected site is clean.

The reported access method also matters for sites that were fully patched. Patchstack said the commands passed the plugin’s signature checks because they were signed with genuine dashboard keys. That points to compromised credentials and trusted remote-control functions, rather than a newly exploited flaw in an installed UpdraftPlus version. Site owners may need to review plugin files, administrator-level capabilities, and accounts in addition to checking the plugin version.

The stakes extend beyond the WordPress site itself. TeamUpdraft says the database held credentials for connected services, while the company advises users who used UpdraftCentral to re-authorize their storage connections and rotate access keys. Whether that is needed for a particular site depends on how it was connected and what credentials it used.

How UpdraftCentral Keys Work

UpdraftPlus includes a client component for UpdraftCentral, a dashboard used to manage multiple WordPress sites. According to the source material, the client remains inactive until a connection key is supplied. Once connected, it can execute commands authorized by that key with the permissions of the user who created it. The default connection option is reportedly selected when linking a TeamUpdraft account in UpdraftPlus settings, so some site owners may have enabled remote management without recognizing that they had created a persistent key.

Nethemba reported that keys did not expire and observed keys created in November 2025 being used after the breach. The firm said the attack came from the attacker’s own server and linked the exposed credentials to UpdraftCentral Cloud. It ruled out a modified plugin, weak cryptography, and the older forgery issue CVE-2026-10795, which it said had been fixed in June in version 1.26.5. The source describes this as the second serious incident involving this channel in five months, but does not provide details here about the earlier incident.

TeamUpdraft said UpdraftPlus downloads and self-hosted UpdraftCentral were not affected. It also said backups stored directly with services such as Google Drive, Dropbox or Amazon S3 were not affected. Those statements do not establish that every connected account or website was safe: the company separately recommends reviewing and re-authorizing storage connections where UpdraftCentral was used.

““Properly apply the revocation in 1.26.12.””

— TeamUpdraft

Affected Keys and Sites Remain Uncounted

TeamUpdraft has not said how many customers or WordPress sites were affected, nor has it published a complete account of which customers’ keys were accessed or used. Nethemba’s review identifies a time range in which keys were not removed by version 1.26.13, but the material provided does not establish how many such keys exist or whether each was misused.

The precise scope of infections also remains unsettled. Patchstack counted 99 plugin names, but that figure is not a count of confirmed affected sites or customers. Researchers reported multiple backdoor variants, including versions that may hide from the plugin list or cause HTTP 500 errors. The recommended cleanup process may change as further variants are identified. TeamUpdraft’s statements that downloads and self-hosted UpdraftCentral were unaffected are the company’s account; the supplied material does not include an independent audit of the breach.

Check Keys, Plugins and Accounts

Site owners should check TeamUpdraft’s latest advisory and the current guidance from Patchstack and Nethemba before deciding what remediation is complete. Users should confirm they are running the applicable updated UpdraftPlus version and determine whether an UpdraftCentral connection was configured, including when its key was created. Keys in the period Nethemba says is not covered by automatic revocation require manual deletion, according to its analysis.

Because revocation does not remove installed code, administrators should also investigate unfamiliar plugins and user accounts rather than treating a successful update as proof of a clean site. Researchers warn that a plugin causing repeated server errors may itself be malicious; their guidance is to remove it, not repair it in a way that could activate its behavior. If a backdoor is found, the source material advises treating the site as compromised and following updated incident-response instructions. TeamUpdraft says it closed the access route, signed out accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys, rotated payment-provider keys, and reported the breach to the UK Information Commissioner’s Office. Further details about the number of affected users and the investigation have not been provided.

Key Questions

Does installing UpdraftPlus 1.26.13 remove a backdoor?

No. The update is intended to revoke certain UpdraftCentral Cloud keys. It does not remove an already installed backdoor plugin or an account created by one.

Which keys does version 1.26.13 revoke?

Nethemba says it removes keys created before 12:07 UTC on October 18, 2026. The firm says keys created from 12:07 to 21:00 UTC that day are not removed and must be deleted manually. TeamUpdraft’s stated cutoff is 22:00 BST, or 21:00 UTC.

Were all UpdraftPlus users affected?

That is not known. TeamUpdraft has not provided a count of affected customers or sites. The reported risk concerns exposed connection keys and sites linked to UpdraftCentral Cloud; the available information does not confirm that every UpdraftPlus installation was exposed.

Were backups in Google Drive, Dropbox or Amazon S3 affected?

TeamUpdraft said backups sent to users’ own storage were not affected. It recommends re-authorizing storage and rotating access keys if UpdraftCentral was used to access a site. The company has not published a site-by-site assessment.

Source: ThorstenMeyerAI.com