The Security Gap In The Fix For Stolen UpdraftCentral Keys

🔍 Read the full analysis: The Security Gap In The Fix For Stolen UpdraftCentral Keys on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft’s fix for keys stolen in a breach of its customer database does not revoke every exposed UpdraftCentral Cloud key, according to security firm Nethemba, leaving some WordPress sites potentially open to commands through the hosted dashboard. The company released UpdraftPlus 1.26.13 on October 19, but updating alone will not remove a backdoor or attacker account already placed on a site.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said attackers accessed the teamupdraft.com website over the weekend of October 17-18 and that it believes they reached its customer database. The database contained customer contact and billing details, order history, password hashes, two-factor authentication settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment card data; Stripe and PayPal handle payments.

UpdraftCentral Cloud keys let a connected WordPress site accept signed commands from the dashboard. Patchstack, which analysed the attack, said attackers used a command to upload and activate plugins, allowing them to install backdoors even on fully patched sites. The security firm counted 99 different plugin names in observed installations between October 18 and 09:23 on October 19. TeamUpdraft said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected.

TeamUpdraft first issued version 1.26.12 on October 19 to revoke older keys. Nethemba said a bug meant that release deleted no keys. The subsequent 1.26.13 release corrected that defect, but Nethemba found it removes keys created before 12:07 UTC on October 18, not keys created between 12:07 and 21:00 UTC. The researchers said those keys must be deleted manually. TeamUpdraft’s stated cutoff was 22:00 British Summer Time, equivalent to 21:00 UTC.

Why the Key Gap Matters

The incident shows how a legitimate remote-management feature can become a route to site compromise when its control keys are exposed. According to Patchstack, commands signed with genuine dashboard keys passed the plugin’s checks; attackers did not need to exploit a software flaw in UpdraftPlus. That meant sites running current plugin versions could still be affected if they had a compromised connection key.

The practical distinction is between revoking access and removing an intrusion. An update can invalidate keys covered by its revocation logic, but it does not undo plugin installations, delete unauthorized accounts or prove that a site is clean. A site where a backdoor was found should be treated as compromised, rather than considered repaired merely because UpdraftPlus was updated.

Exposure may also be less visible to site owners than expected. Nethemba said the setting to add a website to UpdraftCentral is selected by default when a TeamUpdraft account is connected in UpdraftPlus settings. The source material also says keys do not expire, and Nethemba observed keys created in November 2025 being used after the breach. That makes older connections relevant to assessing exposure.

How UpdraftCentral Keys Were Exposed

UpdraftPlus includes a client for UpdraftCentral, which can remain dormant until a connection key is used. Once connected, a WordPress site accepts commands signed with that key, with permissions associated with the user who created it. This design allows remote site administration, but in this incident it meant stolen keys could authorize actions without a separate software vulnerability.

Nethemba said it identified the attack on three of its own sites and attributed the commands to keys leaked from the UpdraftCentral Cloud environment. The firm said it ruled out a modified plugin, weak cryptography and the older key-forgery issue CVE-2026-10795, which had been fixed in June in version 1.26.5. The attack therefore differs from an exploit that bypasses the plugin’s authentication checks: the commands appeared properly signed.

Patchstack described backdoors that wait for a secret URL parameter, then create an account often named in a pattern such as “data-ops43” or “media-staff96.” The account may receive elevated capabilities and a persistent login cookie. Some variants reportedly hide from the plugin list. Patchstack and Nethemba warned that removing a broken-looking plugin is safer than repairing it if it may be one of these backdoors, because repairing an early variant that causes HTTP 500 errors could allow its token check to run.

“The commands are correctly encrypted and signed with genuine dashboard private keys.”

— Patchstack

Exposure and Cleanup Still Unclear

TeamUpdraft has not said how many customers or WordPress sites were affected. The company said it closed the access route, signed out all accounts, disconnected all UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also reported the incident to the UK’s Information Commissioner’s Office. The source material does not establish whether every exposed key has been identified or whether all affected sites have been found.

It is also unclear which customers had UpdraftCentral connections, when their keys were created, or whether those connections were used to install a backdoor. The reported manual-revocation window is specific: Nethemba said keys created between 12:07 and 21:00 UTC on October 18 were not removed by 1.26.13. Keys created after the cutoff are intentionally left in place, so administrators need to establish when their own keys were generated. Cleanup guidance may change as researchers identify additional backdoor variants.

What Site Owners Should Check

Administrators using UpdraftPlus should install the current release specified by TeamUpdraft and review the company’s latest incident advisory alongside Patchstack’s and Nethemba’s findings. They should check whether the site was connected to UpdraftCentral, determine when its key was created and manually revoke keys that fall within the reported gap, following the vendor’s current instructions.

Sites with suspicious plugins or unauthorized accounts need a separate incident response; the version update does not remove them. TeamUpdraft recommends re-authorizing storage connections and rotating access keys if UpdraftCentral was used to access a site. Backups sent directly to customer-controlled storage such as Google Drive, Dropbox or Amazon S3 were not affected according to the source material, but the relevant storage credentials should still be reviewed where a compromised site had access to them. Further clarity depends on TeamUpdraft’s continuing advisories and investigation, including information on the number of affected customers and sites.

Key Questions

Does UpdraftPlus 1.26.13 revoke all stolen UpdraftCentral keys?

No. Nethemba said it revokes keys created before 12:07 UTC on October 18, 2026, but leaves keys created between 12:07 and 21:00 UTC that day. The firm said those keys require manual deletion.

Does updating remove an installed backdoor?

No. The update addresses key revocation; it does not remove a backdoor plugin or an unauthorized account already installed on a WordPress site. Those require separate investigation and cleanup.

Were all Updraft products or customer backups affected?

TeamUpdraft said the UpdraftPlus plugin, its downloads and self-hosted UpdraftCentral were not affected. It also said backups stored directly in services such as Google Drive, Dropbox or Amazon S3 were not affected. The customer database did contain connection keys for UpdraftVault and UpdraftClone.

How did attackers install backdoors on patched sites?

Patchstack said attackers used exposed, genuine UpdraftCentral keys to send signed commands that uploaded and activated plugins. The reported method used authorized dashboard commands rather than a vulnerability in the installed UpdraftPlus version.

How many customers or sites were affected?

TeamUpdraft had not disclosed the number of affected customers or WordPress sites in the source material. The scale of the incident remains unknown.

Source: ThorstenMeyerAI.com