How To Close The Gap In The UpdraftCentral Key Fix For WordPress

🔍 Read the full analysis: How To Close The Gap In The UpdraftCentral Key Fix For WordPress on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get privacy and security gear delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft’s UpdraftPlus 1.26.13 update revokes some connection keys exposed in a recent breach, but security firm Nethemba says it does not remove keys created during part of October 18, 2026. Attackers used stolen UpdraftCentral keys to install backdoors on WordPress sites, and updating alone will not remove a backdoor already installed.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said on October 19 that attackers accessed the teamupdraft.com website over the October 17-18 weekend and that the customer database may have been reached. The database included customer contact and order details, hashed account passwords, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft said it held no payment-card data; Stripe and PayPal process payments.

UpdraftCentral Cloud lets site owners manage connected WordPress sites from a hosted dashboard. According to Patchstack’s analysis, attackers used stolen keys to send a signed command to upload and activate a plugin. Because the command used genuine keys, the plugin’s normal checks passed; the attack did not require a new software vulnerability, and patched sites could still be affected.

TeamUpdraft released UpdraftPlus versions 1.26.13 (free) and 2.26.13 (Premium) to revoke exposed keys. Nethemba says the update deletes keys created before 12:07 UTC on October 18. It reports that keys created from 12:07 to 21:00 UTC that day remain, despite TeamUpdraft’s stated cutoff of 22:00 BST, equivalent to 21:00 UTC. The source material says those keys must be deleted manually.

Why Key Revocation Is Not Cleanup

The incident shows how a trusted remote-management connection can turn a stolen credential into control over connected sites. An UpdraftCentral key authorizes commands under the permissions of the user who created it, including plugin installation. In this case, valid authorization—not a flaw in the patched plugin—was the route used, according to Patchstack.

The response has two separate jobs: block further use of exposed keys and find and remove any access already established. Updating UpdraftPlus addresses only the first job, and even that revocation may not cover every key. A backdoor plugin can create a privileged account and preserve a login route; removing the plugin alone may not delete the account. Site owners therefore need to treat evidence of a backdoor as a broader compromise, not as a problem solved by installing the update.

There may also be sites with a connection key that their owners do not remember creating. The source material says the option to add a site to UpdraftCentral is checked by default when connecting a TeamUpdraft account in UpdraftPlus settings. That default, together with keys that do not expire, can widen the set of sites requiring review.

How the Leaked Keys Were Used

UpdraftPlus includes an UpdraftCentral client that remains dormant until a connection key is configured. Once connected, it accepts commands signed with that key. Patchstack found that the attackers used a command identified as plugin.upload_plugin, which led WordPress to install and activate an uploaded plugin.

Patchstack counted 99 plugin names used between the afternoon of October 18 and 09:23 on October 19. The source material identifies “Site Health Cache” among recurring names and gives the description “Small maintenance toolkit: keeps option storage tidy” as a useful marker. Researchers describe variants that create accounts with elevated capabilities and may hide from the plugin list. One early version reportedly caused HTTP 500 errors before its activation check; Nethemba and Patchstack warn that repairing that error could allow the backdoor to run.

Nethemba said it found the attack on three of its own sites and traced use of keys to the attacker’s server. It ruled out a modified plugin, weak cryptography and the older forgery issue CVE-2026-10795, which it says was fixed in June in version 1.26.5. The source describes this as the second serious incident involving this channel in five months.

““The commands are correctly encrypted and signed with genuine dashboard private keys.””

— Patchstack

Key Exposure and Site Impact

TeamUpdraft has not said how many customers or WordPress sites were affected, and the source material does not establish the full number of keys accessed or used. The company’s statement that the database was likely reached is distinct from a complete accounting of what attackers obtained.

It also remains unclear how many exposed keys fall within the October 18 gap identified by Nethemba, or how many sites still have a backdoor or attacker-created account. Cleanup advice may change as researchers identify additional variants. TeamUpdraft said UpdraftPlus itself, its downloads and self-hosted UpdraftCentral were not affected; that does not mean sites connected to UpdraftCentral Cloud escaped the attack.

TeamUpdraft says backups stored in customers’ own services, including Google Drive, Dropbox and Amazon S3, were not affected. However, it recommends re-authorizing storage and rotating access keys if UpdraftCentral was used to access a site. The source also says the company reported the incident to the UK’s Information Commissioner’s Office, signed out accounts, disconnected UpdraftVault sites and replaced or rotated several other keys.

Steps for Site Owners Now

Site owners using UpdraftPlus should install the current vendor-recommended version and check TeamUpdraft’s latest advisory alongside the Patchstack and Nethemba analyses. They should review whether their sites were connected to UpdraftCentral Cloud, including connections they may not recall setting up, and check the creation time of relevant keys. According to Nethemba, keys from the reported October 18 window require manual deletion rather than relying on the update.

Owners should also inspect for suspicious plugins and accounts, using the researchers’ indicators as a starting point rather than treating a name alone as proof. If a backdoor is found, the source advises removing it rather than attempting to repair a crashing variant, and treating the site as compromised. The account and any other persistence need separate review; a plugin update or deletion is not, by itself, evidence that unauthorized access has ended.

TeamUpdraft’s continuing incident guidance and researcher analyses are the next sources to watch for revised cleanup steps and fuller impact figures. The company has not provided a total count of affected customers or sites in the supplied material.

Key Questions

Does updating UpdraftPlus remove an installed backdoor?

No. The update is intended to revoke connection keys; it does not remove a backdoor plugin or an account that may already have been created on a site.

Which UpdraftPlus versions were released to address the keys?

TeamUpdraft released version 1.26.13 for the free plugin and 2.26.13 for Premium, according to the source material. Check the vendor’s current advisory for the latest instructions.

Why might a key still need manual removal?

Nethemba says version 1.26.13 removes keys created before 12:07 UTC on October 18, 2026, but not keys created from 12:07 to 21:00 UTC that day. It says keys in that interval must be deleted manually.

Were customer payment cards or personal backups exposed?

TeamUpdraft said payment-card data was not stored in the affected database and that Stripe and PayPal handle payments. It also said backups sent to customers’ own storage services were not affected, while recommending re-authorization and access-key rotation if UpdraftCentral was used.

How many sites were affected?

The company had not provided a total count in the source material. Patchstack reported 99 plugin names used during the attack period, but that is not a count of affected sites.

Source: ThorstenMeyerAI.com