Stolen UpdraftCentral Keys Backdoor WordPress Sites

TeamUpdraft confirmed on Monday that an intruder accessed its customer database and took the UpdraftCentral connection keys that are now being used to install backdoor plugins on WordPress sites.

UpdraftCentral is the vendor’s remote site management service, and its client ships with every copy of UpdraftPlus, the most widely installed WordPress backup plugin, with more than 4 million active installations.

Patchstack rates the incident 9.8 on the CVSS scale and has issued no CVE, because nothing in the plugin is broken. Its telemetry recorded backdoor installations running continuously from 15:32 on 18 October to 09:23 on 19 October. Hosting provider Levamo put the figure at more than 100 compromised sites by Monday and said the attacks were still in progress.

The commands are encrypted and signed with genuine dashboard private keys, so every security check inside UpdraftPlus passes. The current releases, 1.26.11 and 2.26.11, are affected in exactly the same way as older ones, and updating the plugin does not stop the attack. The only available fix for site owners is to delete the UpdraftCentral key stored on the site.

Slovak security firm Nethemba discove r ed the campaign on three of its own WordPress sites in the early hours of 19 October and published the first analysis the same day. Its sites were fully patched, and researcher Pavol Lupták ruled out every site-side explanation in turn: the UpdraftPlus files were byte-for-byte identical to the official release, the key fingerprints matched daily backups dating back to 15 October, the cryptography was sound, and no unauthorized administrator or plugin upload appeared in the logs. The requests also carried the wrong fingerprint — genuine dashboard traffic identifies itself with a library version and a teamupdraft.com URL, while these came from the attacker’s own server without either.

How does the attack reach a site?

The attacker first sends a message addressed to a non-existent key, probe.central.updraftplus.com . The site replies that it does not understand it, which confirms it accepts UpdraftCentral commands. Hours later, the real command arrives, signed with the site’s actual key, and WordPress installs and activates the attacker’s plugin through its own standard installer. No confirmation prompt appears, and the site owner is not notified.

Each delivered plugin is a backdoor. It hooks WordPress early on every request and waits for a secret URL parameter carrying a 32-character token. Given that token, it creates an account with a hardcoded password and the Editor role, then separately grants that account manage_options and install_plugins , and logs the visitor straight into wp-admin by setting an authentication cookie.

Both design choices matter. The account appears in the user list as an Editor, so reviewing the administrator list misses it entirely, while install_plugins permits arbitrary code execution and manage_options permits self-promotion to a full administrator. And because the login happens by cookie rather than through the login form, two-factor authentication, login attempt limits, and login protection plugins never run. The account also survives the removal of the plugin, with a password the attacker already knows.

A coding mistake in the current samples is the only reason this wave was caught quickly. The backdoor defines its constants globally but reads them as class constants, so PHP 8 throws a fatal error before the token check runs, and the site returns HTTP 500 on every uncached request. Nethemba’s first warning was an automated WordPress email an error in a plugin it had never installed. Fixing that error would enable the backdoor, so affected plugins should be removed rather than repaired.

Patchstack has identified 99 distinct backdoor plugin names, nearly all of which are randomized two- or three-word combinations used once each. One name, Site Health Cache , recurs.

A more reliable indicator is the plugin description, which is identical across all samples: “Small maintenance toolkit: keeps option storage tidy.” Supporting markers include a user with an @example.org email address, the display name “Site Tools”, a username of two words plus two digits, and a database option ending in _sync_token .

What TeamUpdraft has said and done

TeamUpdraft said it identified unauthorised access to teamupdraft.com over the weekend of 17–18 October. The customer database holds names, email addresses, billing addresses, order history, hashed passwords, two-factor settings, and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. Payment details are handled by Stripe and PayPal and are not stored. The plugin and its downloads were not touched, backups sent to remote storage such as Google Drive or Amazon S3 are unaffected, and self-hosted UpdraftCentral dashboards are not involved.

The company has closed the access route, signed out every account, disconnected all sites from UpdraftVault, replaced every UpdraftClone client key, and rotated its keys with payment providers. It is also preparing an emergency UpdraftPlus release that will automatically disconnect every UpdraftCentral connection created before 22:00 BST on 18 October. That release had not shipped at the time of writing, and TeamUpdraft has not said how the attacker got in or how many sites received commands.

“Your UpdraftCentral connection keys can send commands to your connected sites,” support and marketing head Joe Whittaker said in the notice, urging customers to secure each site directly rather than wait for the update.

Site owners should check for a key even if they have never knowingly used UpdraftCentral. The checkbox on the TeamUpdraft account connection screen — “Add this website to UpdraftCentral (remote, centralised control)” — is ticked by default, so a single account login can enroll a site that has only ever used UpdraftPlus for backups.

The keys never expire; Nethemba found keys issued in November 2025 still working in October 2026. The vendor previously estimated that fewer than 10% of installations have an UpdraftCentral or Migrator key, which still puts the exposed population at around 400,000 sites.

To check and clear the key, open Settings > UpdraftPlus Backups > Advanced Tools > UpdraftCentral and delete every entry under “Manage existing keys”, or run wp option delete updraft_central_localkeys from the command line. Removing the site from the UpdraftCentral dashboard is not sufficient because the key that matters lives on the site. Backups continue to run normally after deletion; only remote management stops.

Anyone who finds a backdoor plugin should delete the UpdraftCentral key first, or the attacker can simply push a corrected replacement. Deactivate the plugin and move it out of the web root rather than uninstalling it through wp-admin, because its uninstall routine erases its own traces. If the backdoor account exists or the trigger parameter appears in access logs, the site should be treated as fully compromised: restore from a backup taken before 18 October, compare files against a clean installation, review every user with extra capabilities, rotate the administrator and TeamUpdraft passwords, and end all sessions.

On one point, the vendor and the researchers disagree. TeamUpdraft’s guidance ends by telling customers to reconnect the site to UpdraftCentral once it has been cleaned. Nethemba, Patchstack, and Levamo all advise against reconnecting until the cause of the key leak has been explained, on the grounds that a new key could reach the attacker the same way the old one did. Nethemba also publishes a read-only checking script and an optional must-use plugin that blocks UpdraftCentral commands outright.

This is the second failure in the same channel in five months. In June, the vendor patched CVE-2026-10795, a CVSS 8.1 flaw in which an obsolete, unsigned message format allowed an attacker to forge UpdraftCentral commands without any keys. That was fixed in 1.26.5 and 2.26.5, but exploitation attempts continue, so connected sites running any earlier version face both problems simultaneously.

Join the conversation. Ask questions, solutions, and help others.

Be the first to start the discussion!