TeamUpdraft confirms breach as stolen UpdraftCentral keys are used to backdoor WordPress sites

TL;DR: An intruder reached the UpdraftPlus maker’s customer database, including the connection keys that let UpdraftCentral send commands to WordPress sites. Researchers say the attacker used those keys to plant backdoors over an 18-hour window.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, has confirmed that an intruder accessed its customer database over the weekend, including the keys its UpdraftCentral service uses to send commands to customers’ WordPress sites. Security researchers say the attacker then used those keys to push backdoor plugins to connected sites between 18 and 19 October.

“We’re aware of the security incident and have taken immediate steps to contain it and protect our customers,” TeamUpdraft said in a statement to CyberSecurityMag. “We’re continuing to investigate and have published an update outlining what happened, the actions we’ve taken and, importantly, the steps customers should take to secure their accounts and connected websites.” The company urged anyone using UpdraftCentral to follow that guidance as soon as possible.

UpdraftPlus has more than four million active installations on wordpress.org, and the UpdraftCentral client ships with every copy, free and premium. Once a site holds an UpdraftCentral key, it executes any command signed by the dashboard with the permissions of the connected user. Nobody approves individual commands.

What TeamUpdraft says was taken

In its incident notice, published on Monday under the name of product and support head Joe Whittaker, the company says it identified unauthorized access to teamupdraft.com over the weekend of 17-18 October and believes the customer database was accessed. That database holds:

• names, email addresses, billing addresses and order history
• account passwords, stored in hashed form
• two-factor authentication settings
• connection keys for UpdraftCentral, UpdraftVault and UpdraftClone

Payments run through Stripe and PayPal, and the company says it never stored card details. It also says the plugin and its downloads were not affected, backups were not kept in customers’ own cloud storage, and self-hosted UpdraftCentral dashboards were not affected.

TeamUpdraft says it has closed the access route, signed out every account, disconnected all sites from UpdraftVault and issued new credentials, replaced every UpdraftClone key and rotated its keys with payment providers. It is also preparing an emergency UpdraftPlus release that will automatically disconnect every UpdraftCentral connection made before 22:00 BST on 18 October. That release had not shipped when I wrote this.

The plugin update is the piece that matters most. Rotating keys on TeamUpdraft’s servers does not protect sites on its own, because each connected site keeps trusting the dashboard key it was issued until that key is deleted on the site itself. Until then, a stolen key still works. TeamUpdraft is telling UpdraftCentral cloud users to secure each site today rather than wait for the release.

The notice does not say how many sites received backdoors.

How it was found

Slovak penetration-testing firm Nethemba caught the campaign on its own sites early on 19 October, when WordPress emailed it about an error in a plugin nobody had installed. Logs traced the plugin to a single signed UpdraftCentral command, plugin.upload_plugin, sent from 43.250.53.42. Two of its three targeted sites were backdoored. The third escaped only because its key belonged to a user who could no longer install plugins.

All three ran current WordPress and UpdraftPlus. Nethemba found no tampering on its side, and the attacker’s requests did not come from TeamUpdraft servers. Because the dashboard’s private keys live only in UpdraftCentral Cloud, the firm concludes they leaked from the service. Patchstack agrees. TeamUpdraft had not responded at the time of writing.

What the backdoor does

Given a secret URL token, the plugin creates an Editor account quietly granted rights to install plugins and change settings, then logs the visitor in by cookie, bypassing two-factor authentication. The account survives the plugin’s removal. A coding bug in the samples crashes the site before the token check runs, which is why victims noticed within minutes. Researchers warn: remove it, don’t fix it.

Patchstack has seen 99 randomized plugin names, all sharing one description: “Small maintenance toolkit: keeps option storage tidy.”

Wider exposure

Keys never expire, and a pre-ticked checkbox enrolls sites in UpdraftCentral when owners link a TeamUpdraft account, so some sites are exposed without their owners knowing. Nethemba estimates up to 400,000 sites hold keys. This is the channel’s second failure since June’s CVE-2026-10795. Patchstack now blocks UpdraftCentral commands for its customers, and host xCloud has warned users that updating won’t help.

What site owners should do now?

1. Check whether the site holds a key, even if you have never used UpdraftCentral. With WP-CLI, run wp option get updraft_central_localkeys from the WordPress root. Any output means the site is exposed.

2. Delete the key on the site itself. In wp-admin, go to Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral, open “Manage existing keys” and delete every one. With WP-CLI: wp option delete updraft_central_localkeys. Removing the site from the UpdraftCentral dashboard alone is not enough, because the attacker holds the dashboard’s side of the key. Backups keep working once the key is gone; only remote management stops. Patchstack says deleting keys remains the right move even after a fix ships, since the attacker already holds keys issued before it.

3. Consider blocking the channel outright. Nethemba has published a three-line must-use plugin that rejects any request carrying an UpdraftCentral message before UpdraftPlus processes it. Note that this also disables migrations through UpdraftPlus Migrator, which uses the same channel.

4. Hunt for the backdoor. Look for plugins carrying the description string above, any user with an @example.org address or the display name “Site Tools”, and Editor accounts that also hold manage_options or install_plugins. Search by capability, not by name. Check the UpdraftCentral log (“View recent UpdraftCentral log events”) for probe.central.updraftplus.com followed by plugin.upload_plugin, but be aware that it keeps only the last 50 events, so on busy sites the record may already be gone. Web server logs are the better source: legitimate dashboard requests include a library version and teamupdraft.com URL in the user agent, and the attacker’s do not. Nethemba has released a read-only checking script that runs through WP-CLI. Run it with plugins skipped, since an installed backdoor will crash WP-CLI as well.

5. If you find it, remove the key first. Otherwise, the attacker can push a corrected version. Deactivate the plugin and move it out of the web root rather than deleting it from wp-admin, because its uninstall routine erases its own traces. Remove the database option ending in _sync_token and the backdoor account.

6. If the account exists, or the trigger parameter appears in your access logs, assume full compromise. Restore from a backup taken before 18 October, compare files against a clean installation, review every user with extra capabilities, rotate administrator and UpdraftCentral Cloud passwords, end all sessions and enable two-factor authentication.

7. Do not reconnect yet. Until TeamUpdraft explains how the keys leaked, a new key could end up in the same hands. If remote management is essential, create the key under an account without the install_plugins capability. On Nethemba’s third site, that detail alone stopped the attack.

Indicators of compromise

• Source IPs: 43.250.53.42; 2a09:bac5:4e21:2e3c::49b:9 (a starting point, not a control)
• User agent: WordPress/6.4; class-udrpc.php (no library version, no URL)
• UpdraftCentral log: probe to probe.central.updraftplus.com, followed hours later by Command received: plugin.upload_plugin
• Plugin description: “Small maintenance toolkit: keeps option storage tidy.”
• Confirmed plugin names: Load Stack 35C, Text Gantry Eb0, Site Health Cache (Patchstack’s advisory lists all 99 observed)
• Accounts: word-word plus two digits, e.g. data-ops43, media-staff96; email at @example.org; display name “Site Tools”; Editor role plus manage_options and install_plugins
• Database: option named after the plugin slug, ending in _sync_token
• Symptom: fatal error “Undefined constant <Class>::FIELD” and HTTP 500 on uncached pages; WordPress error emails naming a plugin you don’t recognize

This story is developing and will be updated when TeamUpdraft ships an emergency UpdraftPlus release.