A Gap In The UpdraftCentral Fix Leaves The Key Issue In Focus

🔍 Read the full analysis: A Gap In The UpdraftCentral Fix Leaves The Key Issue In Focus on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get privacy and security gear delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft says attackers accessed its website over the October 17-18 weekend and likely reached a customer database containing UpdraftCentral Cloud connection keys, which can authorize commands on connected WordPress sites. The company released UpdraftPlus 1.26.13 to revoke exposed keys, but security researchers report that some keys created during the breach window remain active, and updating does not remove malicious plugins or accounts already placed on a site.

In an incident notice dated October 19, TeamUpdraft, the company behind the UpdraftPlus backup plugin, said the compromised database may have contained customer names, email and billing addresses, order histories, hashed account passwords, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment-card data; Stripe and PayPal process payments. It also said backups stored directly with services such as Google Drive, Dropbox or Amazon S3 were not affected.

TeamUpdraft said it closed the access route, signed out accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It reported the incident to the UK Information Commissioner’s Office. The company said the UpdraftPlus plugin, its downloads and self-hosted UpdraftCentral were not affected. Those assurances do not establish whether any particular customer account or connected site was accessed.

TeamUpdraft first issued UpdraftPlus versions 1.26.12 and 2.26.12 on October 19, intending to revoke affected UpdraftCentral Cloud keys. Security firm Nethemba said its code review found the revocation in 1.26.12 deleted no keys. TeamUpdraft then released versions 1.26.13 (free) and 2.26.13 (Premium). Nethemba said the corrected update removes keys created before 12:07 UTC on October 18, but does not remove keys created from 12:07 to 21:00 UTC that day. The vendor’s stated cutoff was 22:00 British Summer Time, equivalent to 21:00 UTC, according to the source material.

Researchers say attackers used valid keys to send commands that uploaded and activated malicious plugins. Patchstack counted 99 different plugin names installed between the afternoon of October 18 and 09:23 UTC on October 19. That figure is a count of names observed in that period, not a confirmed count of affected sites. A frequently seen description was “Small maintenance toolkit: keeps option storage tidy.”

Why Revoking Keys Is Not Cleanup

The incident matters because these keys provide a route to issue commands on connected WordPress sites. Patchstack said the observed command, plugin.upload_plugin, used genuine dashboard signing keys and passed the plugin’s checks. The researchers said an attacker therefore did not need to exploit a software vulnerability in the site itself; even a fully patched site could be affected if it had an exposed, usable connection key.

Installing the update addresses only part of the risk. According to the source material, revocation does not remove a backdoor plugin or accounts created by one, and keys outside the revocation cutoff require separate attention. Nethemba and Patchstack also warned that some malicious plugin variants can hide from the plugin list or cause HTTP 500 errors. A site owner who finds such a plugin should treat it as a security incident, rather than assuming that updating UpdraftPlus has restored the site.

The exposed information also includes customer contact and account data, although passwords were stored as hashes and payment-card data was not held by TeamUpdraft. The company has not disclosed the number of customers or sites involved, leaving the scale of possible exposure unknown.

How Cloud Keys Reached Sites

UpdraftPlus includes a client component for UpdraftCentral. It remains inactive until a site is connected with a key; after connection, the site can accept commands signed with that key, with permissions associated with the user who created it. The source material says the setting to add a site to remote UpdraftCentral control is ticked by default when connecting a TeamUpdraft account. Nethemba also reported the default behavior in the Premium version.

Nethemba said it found the attack on three of its own sites and assessed that keys leaked from the UpdraftCentral Cloud environment, then were used from an attacker-controlled server. It said it ruled out a modified plugin, weak cryptography and the earlier forgery issue CVE-2026-10795, which was fixed in June in version 1.26.5. Nethemba also observed keys created in November 2025 being used after the breach, suggesting that at least some keys did not expire. These are researchers’ findings, not a complete public account of TeamUpdraft’s investigation.

“The UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected.”

— TeamUpdraft, in its October 19 incident notice

How Many Sites Remain Exposed

TeamUpdraft has not said how many customers, keys or WordPress sites were affected, nor has it publicly described the full path by which attackers accessed its website. The available material also does not establish which customers had UpdraftCentral enabled or whether every key in the reported time window was used.

The reported gap concerns keys created between 12:07 and 21:00 UTC on October 18. Nethemba says those keys are not removed by version 1.26.13 and must be deleted manually. The exact cleanup steps and advice may change as researchers identify additional backdoor variants. No public figure is provided for how many malicious plugins remain installed or how many sites have been fully investigated.

Check Keys and Investigate Sites

TeamUpdraft customers should consult the current vendor advisory and the latest Patchstack and Nethemba analyses, then update UpdraftPlus to the relevant fixed release. Site owners who used UpdraftCentral should check whether their connection keys fall within the reported gap and manually revoke keys that the update does not remove. The source material also advises re-authorizing external storage connections and rotating their access keys when UpdraftCentral was used to access a site.

Updating alone is not evidence that a site is clean. Owners should look for suspicious plugins and accounts, including plugins with the reported maintenance-toolkit description, and treat a discovered backdoor as a compromise requiring investigation and removal. TeamUpdraft’s public reporting on the number of affected customers, its investigation findings and any revised cleanup guidance would clarify the remaining scope.

Key Questions

What did attackers access?

TeamUpdraft said attackers accessed the teamupdraft.com website and that the company believes they reached a customer database. It said the database may have contained customer details, hashed passwords, two-factor authentication settings and connection keys for several services.

Does UpdraftPlus 1.26.13 remove every exposed key?

No. Nethemba said the update removes keys created before 12:07 UTC on October 18, 2026, but leaves keys created from 12:07 to 21:00 UTC that day. The researchers said those keys must be deleted manually.

Does updating remove an installed backdoor?

No. The update revokes certain keys; it does not remove a malicious plugin or account already installed on a WordPress site. A site where a backdoor is found needs separate investigation and cleanup.

Were payment cards or stored backups affected?

TeamUpdraft said it did not store card data because Stripe and PayPal handle payments. It also said backups sent directly to customer storage, including Google Drive, Dropbox or Amazon S3, were not affected. It advised customers who used UpdraftCentral to access a site to re-authorize storage and rotate its access keys.

How many customers or sites were affected?

TeamUpdraft has not disclosed a total. Patchstack reported 99 different plugin names observed during a specified period, but that is not a count of affected sites.

Source: ThorstenMeyerAI.com