Why The Stolen Key Issue Is A WordPress Security Concern

🔍 Read the full analysis: Why The Stolen Key Issue Is A WordPress Security Concern on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get smart everyday buys delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft said on October 19, 2026, that attackers accessed its website and likely reached a customer database containing UpdraftCentral Cloud connection keys, which can authorize commands on linked WordPress sites. Security researchers report the stolen keys were used to install backdoor plugins, so updating UpdraftPlus alone may not remove an existing compromise.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said attackers accessed teamupdraft.com over the weekend of October 17–18 and that the customer database may have been reached. According to the company, the data included names, email and billing addresses, order history, password hashes, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said payment card information was not stored in the database because Stripe and PayPal process payments.

TeamUpdraft released UpdraftPlus 1.26.13 and 2.26.13 Premium to revoke affected keys after an earlier release, version 1.26.12, failed to do so, according to security firm Nethemba. Nethemba’s review says the newer release revokes keys created before 12:07 UTC on October 18, but leaves a window of keys created between 12:07 and 21:00 UTC that must be deleted manually. TeamUpdraft’s stated cutoff was 22:00 British Summer Time, equivalent to 21:00 UTC.

Patchstack’s analysis found attackers sent a command to upload a plugin, which WordPress then installed and activated. The command was signed with genuine UpdraftCentral credentials, so the plugin’s normal authorization checks accepted it. Patchstack counted 99 different plugin names installed between the afternoon of October 18 and 09:23 on October 19. That is a count from the researchers’ analysis, not a measure of the total number of affected sites; TeamUpdraft has not disclosed how many customers or sites were affected.

Why Stolen Keys Could Install Backdoors

The incident shows why valid management credentials can pose a serious risk even when the site’s software is current. UpdraftPlus includes a client that can accept commands from UpdraftCentral when a connection key has been configured. Patchstack said the attacker’s command was correctly signed with genuine dashboard keys, allowing it to pass the plugin’s checks. The reported attack did not require a new software flaw on each target site.

Some site owners may not realize they created a remote-control connection: the option to add a site to UpdraftCentral is selected by default when connecting a TeamUpdraft account in UpdraftPlus settings, according to the source report. Nethemba also found keys dating to November 2025 in its investigation and said keys do not expire. These details mean old connections could remain relevant, though the number of sites with exposed or misused keys is unknown.

A key revocation and a site cleanup solve different problems. Revoking a key can prevent further commands using that key, but it does not remove a plugin or account already added to a site. The described backdoor can create an account with elevated capabilities and maintain access through a persistent login cookie. Removing only the malicious plugin may leave the account behind; some variants can also hide in the plugin list.

How UpdraftCentral Fits In

UpdraftCentral Cloud is TeamUpdraft’s hosted dashboard for managing multiple WordPress sites. A site linked to the service can receive commands authorized by its connection key. The affected keys are distinct from backup files stored in a site owner’s own Google Drive, Dropbox or Amazon S3 account. TeamUpdraft said those backups were not affected, but recommended re-authorizing storage connections and rotating their access keys when UpdraftCentral had been used to access the site.

TeamUpdraft said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected. It also said it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. The company reported the breach to the UK Information Commissioner’s Office. Separately, Nethemba said it found the attack on three of its own sites and attributed the leaked keys to the UpdraftCentral Cloud environment. It ruled out a modified plugin, weak cryptography and an older key-forgery flaw fixed in June 2026 in version 1.26.5.

“The commands are correctly encrypted and signed with genuine dashboard private keys.”

— Patchstack

Affected Sites and Key Windows

The total number of affected customers and sites remains undisclosed. TeamUpdraft has not said how many records attackers accessed, how many stolen keys were used, or how many sites received a backdoor. The company’s investigation and the researchers’ analyses were still developing in the source material.

The exact set of keys requiring manual removal is also significant. Nethemba’s review identifies keys created between 12:07 and 21:00 UTC on October 18 as outside the revocation performed by version 1.26.13, while TeamUpdraft’s stated cutoff extends to 21:00 UTC. Site owners may not know when a key was created. Connections made after the cutoff were not revoked, and the update does not establish whether a site was previously compromised.

Backdoor variants differ, and cleanup guidance may change as researchers find more. A plugin that causes HTTP 500 errors should not be repaired casually: Nethemba and Patchstack warn that fixing one early variant could allow its token check and backdoor behavior to run. The source material does not provide a confirmed, complete list of indicators that can identify every affected installation.

Actions for Site Administrators

Administrators should install the current UpdraftPlus release and consult the latest TeamUpdraft advisory alongside Patchstack’s and Nethemba’s analyses. Updating is necessary for the key revocation described by the vendor, but it is not a substitute for checking the site. Owners should review UpdraftCentral connections and determine whether any keys fall into the period Nethemba says requires manual deletion.

Where a suspicious plugin or account is found, site owners should treat the installation as compromised rather than relying on the plugin update alone. The reported backdoor may leave an account after its plugin is removed, and variants may hide themselves. Administrators should follow current incident-response guidance, review accounts and access, and rotate relevant credentials and storage keys. TeamUpdraft’s public disclosure, subsequent technical updates and any revised cleanup instructions are the next developments to watch; no further timeline or affected-site count was provided.

Key Questions

Does updating UpdraftPlus remove an installed backdoor?

No. The update addresses key revocation, but according to the source material it does not remove a backdoor plugin or account already installed on a site. Affected sites need separate inspection and cleanup.

Were WordPress sites with the latest updates affected?

Patchstack reported that sites running current software were affected because the attackers used valid UpdraftCentral keys to send an authorized plugin-install command. Its analysis did not require a new vulnerability on each target site.

Were stored backup files or payment card details exposed?

TeamUpdraft said backups stored in customers’ own Google Drive, Dropbox or Amazon S3 accounts were not affected. It also said card data was not stored in the breached database because Stripe and PayPal handle payments. The company said the database did contain other customer details and connection keys.

Which connection keys may need manual deletion?

Nethemba’s review says UpdraftPlus 1.26.13 revokes keys created before 12:07 UTC on October 18, 2026, but not keys created between 12:07 and 21:00 UTC that day. Nethemba says those keys must be deleted manually. Check the latest vendor and researcher guidance because the response remains developing.

How many sites were affected?

TeamUpdraft has not disclosed the number of affected customers or sites. Patchstack counted 99 plugin names in installations it analyzed during the reported period; that figure does not establish the total number of compromised sites.

Source: ThorstenMeyerAI.com