What The Gap In The UpdraftCentral Fix Means For WordPress Users

🔍 Read the full analysis: What The Gap In The UpdraftCentral Fix Means For WordPress Users on ThorstenMeyerAI.com

Age 18–24?Offer from Amazon

Prime made for students and young adults

• Fast, free delivery for dorm and study essentials
• Prime Video and Amazon Music included
• Member-only deals

Try Prime for Young Adults →Free trial for eligible 18–24 year olds

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft’s revised UpdraftPlus 1.26.13 update revokes exposed UpdraftCentral Cloud keys, but security firm Nethemba says the fix leaves keys created during part of October 18 active. Attackers used stolen keys to send commands that installed backdoor plugins on WordPress sites, so site owners may need to remove malicious files and accounts separately; updating alone does not clean an already compromised site.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, disclosed on October 19 that attackers accessed its teamupdraft.com website over the October 17–18 weekend. The company said the attackers may have reached a customer database containing UpdraftCentral connection keys. TeamUpdraft said the UpdraftPlus plugin and its downloads, as well as self-hosted UpdraftCentral, were not affected by the breach.

TeamUpdraft first released version 1.26.12 on October 19 to revoke keys created before the incident. Nethemba’s code review found that this version did not delete the keys. The company then released version 1.26.13 that evening. Nethemba reports that the corrected update deletes keys created before 12:07 UTC on October 18, but leaves keys from 12:07 to 21:00 UTC that day. Those keys, according to the security firm, must be deleted manually. TeamUpdraft’s stated cutoff is 22:00 British Summer Time, or 21:00 UTC.

The affected keys let UpdraftCentral Cloud issue commands to connected WordPress sites. Security company Patchstack said attackers used a command to upload and activate plugins. It counted 99 plugin names used in the attack between the afternoon of October 18 and 09:23 on October 19. TeamUpdraft said it signed out accounts and disconnected UpdraftVault sites, among other response measures, but has not disclosed how many customers or sites may be affected.

Why Key Revocation Is Not Cleanup

The incident matters because a stolen UpdraftCentral key can authorize commands on a connected site without exploiting an outdated plugin. Patchstack said the commands were correctly signed using genuine dashboard keys, meaning the sites’ built-in checks accepted them. Sites running current software could still be affected if attackers had a valid key for them.

TeamUpdraft’s update addresses access through keys covered by its revocation cutoff. It does not remove a backdoor plugin that an attacker already installed, nor does it remove accounts created by that plugin. Nethemba and Patchstack warn that some malicious plugins can hide from the WordPress plugin list; some variants may also cause errors. Site owners should not assume a site is clean because the update succeeded or a suspicious plugin was removed. Finding a backdoor means the site’s integrity is in question, and the appropriate recovery steps may depend on what was installed and what access it gained.

The disclosed database also contained customer contact and billing details, order history, hashed passwords, two-factor authentication settings and keys for UpdraftCentral, UpdraftVault and UpdraftClone, according to TeamUpdraft. The company said payment card data was not stored in that database and that Stripe and PayPal handled payments. It advised users who connected sites through UpdraftCentral to re-authorize storage and rotate access keys, a precaution that matters if a site connection could have exposed those credentials.

How Cloud Keys Reached Sites

UpdraftPlus includes a client for UpdraftCentral, a hosted dashboard used to manage multiple WordPress sites. The client is dormant until a site receives a connection key. According to the source account, once connected, the site accepts properly signed commands with the permissions of the user who created the key. The default option to add a site to UpdraftCentral when connecting a TeamUpdraft account is reportedly enabled, so some site owners may have created a connection without realizing it.

Nethemba said it found the attack on three of its own sites and traced the activity to keys from the UpdraftCentral Cloud environment, rather than a modified plugin or weak cryptography. It also said keys did not expire and observed keys created in November 2025 being used after the breach. The researchers distinguished this incident from CVE-2026-10795, an earlier key-forgery issue fixed in UpdraftPlus 1.26.5 in June.

The customer database reportedly held names, email and billing addresses, order history, password hashes, two-factor settings and service keys. TeamUpdraft said backups stored directly with providers such as Google Drive, Dropbox or Amazon S3 were not affected. It reported the incident to the UK Information Commissioner’s Office, according to the company’s incident notice.

“The commands are correctly encrypted and signed with genuine dashboard private keys.”

— Patchstack

How Many Sites Remain Exposed

TeamUpdraft has not said how many customers, connection keys or WordPress sites were affected. It is also not clear from the supplied material how many sites received a backdoor, whether all exposed keys were used, or whether the attackers accessed information beyond the database described by the company.

The precise cleanup guidance may change as researchers identify additional backdoor variants. Nethemba’s reported date window for keys left active differs from TeamUpdraft’s stated cutoff, and the source material says keys in the gap require manual deletion. Site owners may not know when a connection key was created, particularly if UpdraftCentral was enabled by default. Neither a successful plugin update nor the absence of an obvious plugin entry confirms a clean site.

Verify Keys and Inspect Sites

Site owners should install the current UpdraftPlus release and consult the latest TeamUpdraft advisory alongside Patchstack’s and Nethemba’s analyses for current instructions. They should check whether UpdraftCentral was connected, establish when its keys were created where possible, and manually revoke any key in the reported gap. TeamUpdraft’s advisory and researcher guidance should be checked again as findings develop.

For sites where a suspicious plugin or account is found, owners should treat the incident as a potential compromise rather than relying on the version update alone. The supplied source material does not set out a complete recovery procedure, so site administrators should follow current incident-response guidance from the vendor and researchers. TeamUpdraft’s investigation, the number of affected sites and further cleanup recommendations remain developing.

Key Questions

Does UpdraftPlus 1.26.13 remove every exposed UpdraftCentral key?

No. Nethemba reports that the update deletes keys created before 12:07 UTC on October 18, 2026, but leaves keys from 12:07 to 21:00 UTC that day. Those keys require manual deletion, according to the researchers.

Will updating UpdraftPlus remove a backdoor plugin?

No. The update revokes covered keys; it does not remove a backdoor plugin or an unauthorized account already placed on a site. Affected sites need separate inspection and cleanup.

Were backups stored in Google Drive or Amazon S3 affected?

TeamUpdraft said backups stored directly with external services such as Google Drive, Dropbox or Amazon S3 were not affected. It recommends re-authorizing storage and rotating access keys if UpdraftCentral was used to access a site.

Was the UpdraftPlus plugin itself compromised?

TeamUpdraft said the UpdraftPlus plugin, its downloads and self-hosted UpdraftCentral were not affected. The attack used stolen UpdraftCentral Cloud keys to send commands to connected sites, according to the company’s notice and researchers.

How many WordPress sites were affected?

TeamUpdraft has not disclosed the number of affected customers or sites. Patchstack counted 99 plugin names used during the observed attack window, but that figure is not a count of affected sites.

Source: ThorstenMeyerAI.com