Stolen UpdraftCentral Keys Used to Backdoor WordPress Sites, Researchers Say

The first victims knew something was wrong because their sites stopped working. A plugin nobody had installed had appeared overnight, and a coding error in it made every uncached page return an HTTP 500 error. That plugin was a backdoor, pushed through UpdraftCentral, the remote management service built into the popular UpdraftPlus backup plugin, using keys the attacker should never have had.

Its developer, TeamUpdraft, says it found unauthorised access to teamupdraft.com over the weekend of 17-18 October and believes its customer database was accessed, including connection keys for UpdraftCentral. Researchers at Nethemba and Patchstack say those keys were then used to sign commands that installed malicious plugins on connected WordPress sites. Because the commands were genuinely signed, the sites had no way to tell them apart from real ones. TSN tracks attacks like this on its Ransomware & Cyber Attacks hub.

The keys came from the vendor, not the victims

TeamUpdraft’s database held names, email addresses, billing addresses, order history, hashed passwords, two-factor settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone, the company says. Card payments run through Stripe and PayPal, and the plugin and its downloads were not affected. Self-hosted UpdraftCentral dashboards are also outside the incident. TeamUpdraft says it has reported the breach to the UK’s Information Commissioner’s Office.

Nethemba, a web security firm, caught the attack on three of its own sites. On two, a signed plugin.upload_plugin command installed and activated an unknown plugin; on the third it failed because the key belonged to a user without permission to install plugins. Nethemba ruled out tampered files, swapped keys and weak cryptography, and concluded the dashboard’s private keys had leaked from the UpdraftCentral Cloud environment, which TeamUpdraft’s disclosure later supported.

“This is not a vulnerability in UpdraftPlus,” Patchstack wrote, noting that every check in the plugin passed. Its telemetry recorded backdoor installations between 16:32 BST on 18 October and the morning of 19 October, under 99 different plugin names. Most were random two- or three-word combinations, but one, “Site Health Cache”, recurred repeatedly. The backdoor creates an account that looks like an Editor but carries the rights to change settings and install plugins, and it logs the attacker in by setting a cookie directly, bypassing the login form and any two-factor protection.

Exposure is wider than UpdraftCentral’s user base might suggest. Patchstack and Nethemba both found that connecting a teamupdraft.com account inside UpdraftPlus ticks a box by default that reads “Add this website to UpdraftCentral”, creating a key whether or not the owner meant to. UpdraftPlus has more than 3 million active installations, according to wordpress.org; the researchers put it above 4 million. Nethemba estimates that up to around 400,000 sites may hold an UpdraftCentral or Migrator key, based on the vendor’s earlier estimate that under 10% of users do. “We do not know how many of them the attacker hit,” it added.

The first emergency release did nothing, and the second misses some keys

TeamUpdraft’s fix is UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium), which it says disconnect every UpdraftCentral connection made before 22:00 BST on 18 October. Nethemba’s code review adds two caveats that change what site owners should do.

The attacker also kept trying. TeamUpdraft said on 20 October that “the unauthorised access was resolved” and that the update had blocked “any access across that vector”. Yet Nethemba reported that between 12:30 and 13:00 BST that day, the attacker tried the secret triggers of already-removed backdoors on at least three sites, two of them its own. It also found that on some sites working backdoors ran for hours before the broken variant crashed them, so a crashed site may already have been entered.

The researchers’ advice is consistent. Update to 1.26.13 or 2.26.13, then go to Settings > UpdraftPlus > Advanced Tools > UpdraftCentral and delete the connection keys, even on sites where a backdoor has already been removed. Check every plugin, including must-use plugins, and look for unfamiliar accounts with extra capabilities, not only administrators. If anything turns up, TeamUpdraft suggests restoring from a backup taken before 17 October, and changing administrator passwords and any remote storage keys. Every teamupdraft.com account holder should change their password.

The open question is the one TeamUpdraft has yet to answer: how the attacker got into teamupdraft.com. Nethemba says it will keep updating its analysis and checking script as new samples arrive. Patchstack’s advice is to hold off reconnecting sites to UpdraftCentral until the vendor explains the cause.

Sources

• TeamUpdraft: TeamUpdraft security incident: What customers need to know, 19 October 2026, updated 20 October 2026
• Nethemba: Critical security problem in UpdraftCentral: an attacker holding the service’s keys planted a backdoor on our websites, 19 October 2026, updated 21 October 2026
• Patchstack: Stolen UpdraftCentral Keys Are Backdooring WordPress Sites, 19 October 2026
• BleepingComputer: Stolen UpdraftCentral keys used to backdoor WordPress sites, 20 October 2026
• WordPress.org: UpdraftPlus plugin page