Stolen UpdraftCentral Keys Are Backdooring WordPress Sites

TeamUpdraft disclosed on Monday that attackers accessed its customer database over the weekend of 17-18 October. Stolen UpdraftCentral keys are already being used to backdoor fully patched WordPress sites with properly signed commands. I run AliasFleet, an email-alias service: one forwarding address per site, so a leak names its source. The database is not the dangerous part of this breach. The keys are.

What the vendor confirmed

The vendor notice went up on 19 October at 11:57 UTC and was last updated on 20 October at 16:25 BST. The page is still moving.

One line in the notice tells you what the company fears most: "We will never ask for your password or keys." It is there because TeamUpdraft knows the names and email addresses in that database are now the raw material for a phishing wave wearing its own branding.

The keys are the story

UpdraftCentral is TeamUpdraft's remote management service, and the client comes bundled in every copy of UpdraftPlus, free and premium alike. A site holding a key executes any command signed with the matching dashboard private key. Those private keys never touch the connected sites; they sit with the UpdraftCentral cloud service. Which means the safety of every connected site hangs on one assumption: that the keys never leave there.

They left. The database held them, and attackers put them to work within hours.

Slovak security firm Nethemba found the campaign on three of its own WordPress sites in the early hours of 19 October and published the first analysis the same day. Patchstack confirmed the findings and extended them. Its telemetry recorded backdoor installs running from 15:32 on 18 October to 09:23 on 19 October (times read as UTC from the page context). It counted 99 different backdoor plugin names. One detail does the detection work: every sample carries the identical plugin description "Small maintenance toolkit: keeps option storage tidy.", and the name "Site Health Cache" is reused repeatedly.

This is not a plugin vulnerability. The commands are correctly encrypted and signed with genuine dashboard private keys. From the site's point of view the instruction is legitimate, so every check in the plugin passes. Patchstack rates it 9.8 CVSS and issued no CVE. There is no code flaw to patch. Every UpdraftPlus version is affected the same way: 4M+ active installs per wordpress.org, free and premium. Updating the plugin does not stop the attack. The fix is deleting the UpdraftCentral key stored on the site. Removing the site from the UpdraftCentral dashboard is not enough, because the key that matters lives on the site.

Nethemba's sites were fully patched and running Wordfence, Patchstack and Cloudflare. None of it stopped a signed command. Nethemba ruled out every site-side explanation in turn: plugin files byte-identical to the official release, key fingerprints matching daily backups back to 15 October, sound cryptography, no unauthorised admin or plugin upload in the logs. The requests even carried the wrong fingerprint. Genuine dashboard traffic identifies itself with a library version and a teamupdraft.com URL. These came from the attacker's own server. Nethemba CEO Pavol Luptak put it plainly: "Whoever holds them can install and run arbitrary code on every connected site without the owner knowing."

The backdoor is built to survive. It watches for a secret URL parameter carrying a 32-character token, then creates an account with a hardcoded password, assigns it the Editor role, and grants manage_options and install_plugins on top. It logs the attacker in with a persistent cookie, so the login form, two-factor authentication and attempt limits never run. The account shows as an Editor, so a glance at the administrator list misses it. Removing the plugin does not remove the account, and the attacker knows its password. Early variants threw HTTP 500 on uncached requests, which is how the first victims noticed within minutes. Do not repair such a plugin. Fixing the error switches the backdoor on. Remove it. One later variant hides from the plugin list entirely.

Then the finding that widens the victim pool. The teamupdraft.com account screen carries a checkbox reading "Add this website to UpdraftCentral (remote, centralised control) - free for up to 5 sites", ticked by default. Leave it ticked and a successful login creates an UpdraftCentral key. Plenty of sites hold keys nobody deliberately created, and keys do not expire: keys issued in November 2025 still worked in October 2026. An estimate Nethemba cites from the vendor's June disclosures puts the share of users holding an UpdraftCentral or Migrator key under 10%, which still means up to roughly 400,000 sites in the exposed surface. Hosting provider Levamo put it at more than 100 compromised sites by Monday, with the attacks still in progress.

If you have ever bought or registered anything through TeamUpdraft, assume your name and email address are in that database. Check Have I Been Pwned once the incident is listed, and walk the breach-response order of operations. Now expect emails wearing TeamUpdraft's name asking you to confirm your password or keys. TeamUpdraft says it will never ask for those. Do not click any link in such a message; type teamupdraft.com into your browser yourself.

What to do today if you run UpdraftPlus

Work through this list in order, logged into each site's own WordPress dashboard. Never through UpdraftCentral.

1. Update to UpdraftPlus 1.26.13 (free) or 2.26.13 (Premium). Not 1.26.12. Nethemba read the code and found 1.26.12 deletes zero keys because of a bug, which the vendor repaired the same evening in 1.26.13. The vendor says 1.26.13 automatically disconnects UpdraftCentral connections made before 22:00 BST on 18 October.
2. Mind the revocation gap. Nethemba's code review found that 1.26.13 deletes only keys created before 12:07 UTC on 18 October. Keys created between 12:07 and 21:00 UTC that day remain on the site. Remove them by hand: Settings, UpdraftPlus Backups, Advanced Tools, UpdraftCentral, delete every key. That finding is Nethemba's reading of the code, not the vendor's claim. Act on it anyway.
3. Check every site for a key, including ones that never used UpdraftCentral. The default-ticked checkbox means keys exist where nobody created them on purpose. Any output from wp option get updraft_central_localkeys means the site holds one.
4. Walk through Plugins, must-use tab included, and flag anything you do not recognise. The strongest indicator is the description "Small maintenance toolkit: keeps option storage tidy." Delete anything suspicious. Never try to repair it.
5. Review Users by capability, not by role. The backdoor account looks like an Editor while holding manage_options and install_plugins. Remove it, and drop the _sync_token database option if it is there.
6. Change every administrator password, end existing sessions, and change your teamupdraft.com password from a clean device. If two-factor is on at teamupdraft.com, reset it in My Account.
7. If you find anything suspicious, consider restoring from a backup taken before 17 October, then re-secure the site before reconnecting anything.
8. Wordfence shipped an emergency firewall rule as a temporary kill switch for the UpdraftCentral command channel, to Premium customers first and Free users a few hours later. Refresh your firewall rules manually. The rule cannot undo anything that happened before it landed, and it temporarily blocks legitimate UpdraftCentral commands too.
9. Do not reconnect to UpdraftCentral until the vendor explains how the keys left its database. Patchstack's advice is to leave the channel dead. Backups keep working after key deletion. Only remote management stops.

The address you can wall off

The second half of this breach is aimed at you personally. The customer database holds your name, your email address, your billing address and your order history. That is a complete phishing kit: real names, real context, and now the perfect pretext, because every UpdraftPlus customer has a reason to expect an urgent email about keys and passwords.

Give TeamUpdraft a dedicated email alias instead of your real address, forwarding to your inbox. The mechanism is simple. The alias belongs to exactly one vendor, so every message on it is either from TeamUpdraft or from the attacker, and there is no third option. A "security update" demanding your password, arriving on an address TeamUpdraft never had, has identified itself as the forgery without you inspecting a single header. That is the leak-tracing mechanism: the alias names the source. Kill the alias and the impersonation channel dies while your real inbox stays clean. The set-up guide takes about two minutes. If you already handed TeamUpdraft your real address, move the account to a fresh alias now, because this database will circulate. Securing your email account is the other half of the work.

Plugin vendors are the inbox nobody thinks to protect. You connect an account to activate a licence. The vendor stores your email next to the keys to your server. One weekend later, both are in someone else's hands.

What to watch next

Three things. First, the entry point. TeamUpdraft says it fixed the "underlying weakness" but has not said what it was. A vendor that cannot name the door cannot promise it is closed. Second, the customer count. No number has been published, and 99 backdoor plugin names is a count of names, not of compromised sites. Third, the 12:07-21:00 UTC gap. The vendor's 20 October update says the unauthorised access was resolved and 1.26.13 revoked the keys, but Nethemba's warning stands: stolen keys keep working until the site deletes them. Any site with a key created in that window is still an open door. The investigation continues. So does the impersonation.