Friday, 23 October 2026Global tech news & guides — what changed, and what it means for you.
AuTechWire
Original illustration: a shadowy hand inserting a glowing golden key into a dark admin dashboard at night, puppet strings rising from plugin icons, red warning glow on one side, teal and amber grade

Stolen UpdraftCentral Keys Are Backdooring WordPress Sites — and Updating the Plugin Is Not Enough

by

In brief

  • TeamUpdraft disclosed on October 19 that attackers accessed its website over the weekend of October 17–18 and got into its customer database — which contained the connection keys for UpdraftCentral, UpdraftVault and UpdraftClone, plus customer account information.
  • The attackers used the stolen keys to send properly signed remote-management commands that installed backdoor plugins on connected WordPress sites. This is not a vulnerability in UpdraftPlus — no plugin patch could have stopped it, because every check in the plugin passes: from the site’s point of view the instruction is legitimate. TeamUpdraft’s October 21 update says the fix (1.26.13) now automatically revokes the old keys by disconnecting sites from UpdraftCentral.
  • Patchstack counted 99 different backdoor plugin names installed in an 18-hour window on October 18–19. The backdoors can create persistent administrator-capable accounts — deleting the plugin alone may not clean the site.
  • The official fix has a gap: the key-revocation update (1.26.12) failed to delete keys, and its replacement (1.26.13) only removes keys created before 12:07 UTC on October 18. Keys created between 12:07 and 21:00 UTC that day must be deleted manually.
  • Wordfence pushed emergency firewall rules to its free users; TeamUpdraft has reported the incident to the UK Information Commissioner’s Office.

What actually happened

UpdraftCentral is the cloud remote-management service from TeamUpdraft, the company behind UpdraftPlus — one of the most widely installed WordPress backup plugins in the world. Site owners connect their sites to UpdraftCentral with a connection key, and from the cloud dashboard they can manage backups, updates and plugins across many sites at once. The client is built into every copy of UpdraftPlus.

On October 19, TeamUpdraft published a security advisory: someone had unauthorized access to teamupdraft.com over the weekend, and the customer database was accessed. That database held the private connection keys — the credentials that let the cloud service issue commands to connected sites.

Here is the part that makes this incident unusual. The attacker did not exploit a bug in WordPress or in UpdraftPlus. They simply used the stolen keys to do what the keys are for: send commands. Patchstack’s analysis is blunt — the commands were correctly encrypted and signed with genuine dashboard private keys, and every check in the plugin passes because the instruction is, cryptographically, legitimate. There is no CVE for this, because there is no code flaw. The latest releases at the time (1.26.11 and 2.26.11.26) were affected exactly like older ones.

The 99-plugin backdoor campaign

The campaign was discovered by Nethemba, a security firm, on its own infrastructure — which tells you something about how indiscriminate it was. On the night of October 19, an attacker at IP address 43.250.53.42 sent the command plugin.upload_plugin through UpdraftCentral to three of Nethemba’s WordPress sites. On two, the command went through and WordPress installed and activated an unknown plugin. On the third it failed on permissions.

All three sites were current — WordPress 7.1.3 and UpdraftPlus 2.26.11, patched against the June vulnerability CVE-2026-10795. The attacker did not break into Nethemba’s servers and did not exploit any weakness in their configuration. As Nethemba puts it: whoever holds the dashboard keys can install and run arbitrary code on every connected site without the owner knowing.

Patchstack, analyzing the attack across the ecosystem, counted 99 different plugin names installed between the afternoon of October 18 and 09:23 UTC on October 19 — names like “Site Health Cache,” “Seo Helper,” “Wp Forge” and “Js Clean,” with a recurring description, “Small maintenance toolkit: keeps option storage tidy,” as a useful indicator of compromise. The installed backdoor can create an account with administrator-level capability (typically assigned the Editor role alongside extra permissions) and can preserve the attacker’s access with a persistent login cookie. Some variants hide from the plugin list. The critical warning from both Patchstack and Nethemba: removing the plugin alone may not remove the account it created.

The campaign ran continuously through roughly an 18-hour window on October 18–19, and Patchstack has deployed mitigation rules covering it. Given the severity, Wordfence made the same firewall rule available to its free users within hours of premium customers receiving it.

The fix has a gap

TeamUpdraft moved fast, but the fix stumbled. Version 1.26.12 of UpdraftPlus, released October 19, was intended to revoke the old UpdraftCentral Cloud keys. Nethemba’s code review found that version did not actually delete the keys. TeamUpdraft then issued 1.26.13 (free) and 2.26.13 (Premium) — but according to Nethemba, the corrected revocation only removes keys created before 12:07 UTC on October 18. Keys created between 12:07 and 21:00 UTC that day are not deleted by the update and require manual removal.

That window matters. TeamUpdraft’s own stated cutoff is 22:00 British Summer Time — equivalent to 21:00 UTC — so the two accounts agree on the end of the window. But if your key was created in that nine-hour stretch, the update does not save you. You have to delete it by hand.

Separately, TeamUpdraft says it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys, rotated keys with payment providers, and reported the incident to the UK Information Commissioner’s Office. Backups sent directly to customers’ own storage — Google Drive, Dropbox, Amazon S3 — were not affected. The company says the plugin itself, its downloads and self-hosted UpdraftCentral were not affected.

October 21 update: TeamUpdraft updated its advisory on October 21 with new facts. The attacker reached the site using a compromised key — not a software flaw — and the company says the speed of the exploit rollout plus the initially faulty backdoor plugins suggest the attackers used AI to accelerate the attack. TeamUpdraft has brought in an external cybersecurity firm and contacted the police, who are investigating. The potentially accessed database held names, email addresses, billing addresses, order history, password hashes, and two-factor authentication settings — no card details, which Stripe and PayPal handle. One figure to read carefully: the roughly 400,000-site number circulating is an estimate of potential exposure, not a confirmed victim count. The company has not reported how many sites were actually breached.

What to do now, in order

If your site has — or recently had — an UpdraftCentral Cloud connection key, work through this list. Do it from a known-clean device.

  1. Check whether you are affected. Log in to the site directly (not through UpdraftCentral). Look at the installed plugins list for anything you did not install — the known indicators include names like “Site Health Cache,” “Seo Helper,” “Wp Forge,” “Js Clean,” or any plugin described as “Small maintenance toolkit: keeps option storage tidy.” Check Users for administrator or unexpected accounts you did not create.
  2. Delete every old UpdraftCentral key. In UpdraftPlus, remove the UpdraftCentral connection. If your key was created between 12:07 and 21:00 UTC on October 18, the 1.26.13 update will not remove it — delete it manually. TeamUpdraft’s October 21 update says 1.26.13 automatically revokes keys by disconnecting sites from UpdraftCentral.
  3. Update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or later. Note: sites under Wordfence’s temporary firewall protection may not accept the new UpdraftCentral connection until that update is installed — follow TeamUpdraft’s current guidance when reconnecting with a new key.
  4. Reset credentials from a clean device. Reset your TeamUpdraft account password (immediately, and everywhere else you reused it — the database held password hashes) and reset your two-factor authentication. Watch for phishing emails claiming to be from TeamUpdraft — the database held your email address. If your site was accessed through UpdraftCentral, also re-authorise your remote storage and change those storage access keys. After the site is known clean, change WordPress administrator passwords, end existing sessions, and rotate any other credentials the compromised site could access (hosting, database, API keys).
  5. If anything suspicious is present, do not just delete the plugin. Restore from a known-clean backup created before October 17, or get a professional cleanup and full incident response — the backdoor’s persistent accounts survive plugin deletion.
  6. If nothing is suspicious, you are probably fine — but keep the firewall rules in place and watch TeamUpdraft’s advisory for updates.

One more thing: do not confuse this with a reason to uninstall UpdraftPlus. Backups keep working, and the plugin itself was not compromised. The problem was the keys, and keys can be replaced.

The bigger lesson: the management channel is the attack surface

This incident belongs to a growing category: attacks on the trust relationship between a vendor’s cloud service and the software on your server. Your site can be fully patched — Nethemba’s were — and still fall, because the attacker never touched your site’s defenses. They walked in through a channel your site is designed to obey.

The same week, the industry watched browser vendors block eight compromised certificate-authority keys from eMudhra. Different layer, same lesson: the infrastructure of trust — keys, certificates, signed commands — is where the high-leverage attacks now happen. For anyone managing WordPress sites at scale, the takeaway is concrete: inventory every remote-management connection you have, know what each one can do, and have a plan for the day the vendor’s side is the one that gets breached.

One more layer down, that same week: two critical flaws in PHP itself — the language underneath WordPress — were disclosed as PHP2Shell. No plugin was buggy and no plugin patch helps: the fix is updating the PHP runtime (8.5.12, 8.4.27, 8.3.36 or 8.2.35), and every PHP site is in scope, not just WordPress.

Sources

Related reading: Eight Broken Keys: What the eMudhra Certificate Compromise Means for You · One Hacker, $5,000, and an Army of AI Agents: How 100+ Company Sites Were Breached

Sources: Patchstack (2026-10-19 — 99 plugin names, 18-hour window, “Small maintenance toolkit” indicator, persistent admin accounts, signed-command mechanism, CVSS 9.8, mitigation rules); Nethemba (2026-10-19 — discovery on own infrastructure, attacker IP 43.250.53.42, plugin.upload_plugin command, 1.26.12 revocation failure, 1.26.13 cutoff 12:07 UTC Oct 18, manual-deletion window to 21:00 UTC); TeamUpdraft, “Security incident: What customers need to know,” updated 2026-10-21 (compromised key used; AI-accelerated attack indicators; external firm; police; database contents: names, emails, billing addresses, order history, password hashes, 2FA settings; no card details; password/2FA reset advice; phishing warning); CSO Online (2026-10-21 — researchers: key revocation does not remove rogue plugins, accounts or sessions; ICO + other authorities notified); The Hacker News (2026-10-21 — 1.26.13 disconnects every UpdraftCentral connection made before 10 p.m. BST October 18; remote-storage re-authorisation precaution); runtimewire (2026-10-21 — 400,000-site figure is potential exposure, not confirmed victims).

Related: the ConnectWise hack used ARTEX, an open-source AI pentesting framework — China’s Storm-0940 hit 2,250+ tenants at 2,900 sign-ins a minute with it. What ARTEX is, and what to check.

Shoaib Hassan

Shoaib Hassan is the founder and editor of AuTechWire, an independent technology publication covering broadband, mobile networks, privacy, startups, and consumer tech.

Related Stories

Leave a Comment