Agentum Cloud
Agentum

Sourced writing from Agentum R&D

Enterprise-Grade, Explained · For business owners

UpdraftPlus keys abused: patched WordPress sites backdoored anyway

By Agentum R&D · 8 min read
Published · Updated

Short answer WordPress sites using the UpdraftPlus backup plugin may hold a secret key that lets its maker’s control page send them orders. The maker believes keys were taken and used to plant hidden entrances, even on updated sites. Ask your web team to copy the site, delete the keys, then check.

WordPress is the software behind many small-business websites. It grows through plugins, add-on programs installed inside the site. UpdraftPlus is a popular backup plugin, made by a company called TeamUpdraft. It also contains UpdraftCentral, a feature that lets one online dashboard, a control page, manage many websites. The link between the dashboard and each site is a connection key, a long secret string that says “this dashboard may give this site orders”.

In October 2026, TeamUpdraft said an intruder had got into its own website and that it believes its customer database was copied, including these connection keys. Within hours, attackers were using valid keys to install backdoors on websites. A backdoor is a hidden way back in that the site owner did not choose. Sites that had already installed the fix for an earlier flaw were hit as well.

If your site uses UpdraftPlus, or a web agency or host runs it for you, you are exposed only if the site holds an UpdraftCentral key. You may hold one without knowing, because the box that creates it is ticked by default. Your site’s admin can see the keys under Settings, UpdraftPlus Backups, Advanced Tools, UpdraftCentral, “Manage existing keys”. The one thing to do: ask whoever runs your site to keep a copy of the site first, then delete every key and check for unknown plugins and administrator accounts. Updating alone is not enough.

Patched sites were backdoored anyway, because the keys were real

The security firm Nethemba found the campaign on its own sites in the early hours of 19 October. Its three sites ran a version that had fixed CVE-2026-10795, a June flaw that let outsiders forge dashboard commands (a CVE is a public catalogue number for a known software flaw). The attacker sent commands to all three; two were backdoored, and the third attempt failed only because of a permissions detailSource 1.

The reason is that nothing was forged. Security company Patchstack says the commands were signed with genuine dashboard private keys, so the plugin’s checks passed, and that this is not a vulnerability in UpdraftPlus at all; no CVE number was assignedSource 2. The plugin did what it was built to do: obey its dashboard.

How the keys got out, as the vendor describes it

TeamUpdraft’s security advisory says unauthorised access to its website, teamupdraft.com, was identified over the weekend of 17 to 18 October. It believes its customer database was accessed. That database holds names, email and billing addresses, order history, password hashes (scrambled forms of passwords), two-factor settings and the connection keys for UpdraftCentral and two sibling servicesSource 3. It says no card details were stored and the plugin files were not affected.

The advisory says the underlying weakness was fixed but does not describe it, and as of 29 October we found no public explanation of how the intruder got in.

Why these keys are so dangerous

Three properties make these keys dangerous, per Nethemba. They never expire: keys made in November 2025 still worked in October 2026. The box that enrols a site into UpdraftCentral is ticked by default, so some owners hold a key they never knowingly made. And removing a site from the dashboard does not delete its key on the site itselfSource 1. A site you “disconnected” may still be listening.

How many sites? UpdraftPlus has over four million active installs. Nethemba cites the vendor’s estimate that fewer than 10% of users hold an UpdraftCentral or Migrator (a site-moving feature) key, which works out to up to about 400,000 sitesSource 1. BleepingComputer repeats it as an estimated 10%Source 4. The vendor made that estimate in June, for the earlier flaw, so it is a rough upper bound on exposure, not a count of victims; the number actually hit is unpublished.

Patchstack counted 99 different backdoor plugin namesSource 2, which Nethemba says are three code variants with names swapped.

Four steps: Nethemba’s sites ran 2.26.11, which had the June fix for CVE-2026-10795; each linked site holds a never-expiring key the vendor believes was taken on 17 to 18 October; genuine signed commands backdoored two of three Nethemba sites (99 plugin names per Patchstack); update 1.26.13 deletes keys made before 12:07 UTC on 18 October but not an installed backdoor.
Image description

Title: Why patched sites were backdoored. Subtitle: UpdraftCentral, 17 to 19 October 2026, in four steps. Step 1, the site was patched: Nethemba’s sites ran 2.26.11, which had the June fix (CVE-2026-10795). Step 2, a key was waiting: each linked site holds a key that never expires; the vendor believes keys were taken on 17 to 18 October. Step 3, highlighted, a real signature: commands carried a genuine signature, so two of three Nethemba sites installed a backdoor; Patchstack counted 99 plugin names. Step 4, updating is not cleaning: 1.26.13 or 2.26.13 deletes keys made before 12:07 UTC on 18 October; an installed backdoor stays. Green box, the fix: copy the site first, delete every key, look for unknown plugins and accounts, then change passwords. Sources: TeamUpdraft advisory (29 October); Nethemba (19 to 26 October); Patchstack (19 October).

Why patched sites were backdoored: the commands carried genuine keys, and an update does not remove a backdoor already installed. Sources: TeamUpdraft advisory; Nethemba; Patchstack, October 2026.

What the backdoor does, and why an update will not remove it

Once a signed command installs a plugin, that plugin sits quietly and waits for a secret value in a web address. When it sees one, it creates an Editor account (a level below administrator) with the rights to change settings and install plugins, or, in one variant, signs in as an existing administrator. Either way it signs the visitor in directly. That skips the login page, so two-factor codes and login-attempt limits never come into play. Any account it made stays after the plugin is deletedSource 2.

Nethemba reports that release 1.26.12 / 2.26.12 was meant to delete old keys but deleted none. Release 1.26.13 / 2.26.13, out on the evening of 19 October, deletes keys created before 12:07 UTC (13:07 UK summer time) on 18 October, so a key made later that day survives and must be removed by handSource 1. By 20 October the update had reached free sites automaticallySource 3. A site that took it is no longer exposed to the keys the vendor believes were taken. It is also not cleaned.

TeamUpdraft’s own 29 October update makes the point sharper. In a small number of cases, sites compromised in the original incident showed no obvious signs, and a plugin the attacker left behind was later used to create a new admin account even after the site had been disconnected from UpdraftCentralSource 3. On the morning of 21 October the attacker was still sending commands to Nethemba’s sites; they were blocked, and the keys had been deletedSource 1. That is why the keys stay dangerous on any site that has not deleted them.

Our reading: update status shows which known holes are closed, not whether someone already walked in. “We are patched” is the wrong answer to “are we clean?”.

Questions to send whoever looks after your site

Before anyone cleans anything, ask for a full copy of the site’s files, database and server logs. Cleaning removes evidence, and the plugin’s own log keeps only the last 50 eventsSource 1. Then send these to your agency, host or developer, and ask for written answers.

  1. Has every UpdraftCentral key, and any Migrator key (the “Migrate / Clone” tab), been deleted on each site? Delete the keys first, before removing any backdoor, or the attacker can push a replacement. Do it on the site itself, because deleting in the dashboard does not remove it, and even if you never used UpdraftCentral, because the default tick may have made oneSource 2.
  2. Is UpdraftPlus on 1.26.13 (free) or 2.26.13 (premium) or later? Not 1.26.12 or 2.26.12, which Nethemba says removed no keys.
  3. Has someone checked for unknown plugins, including hidden ones? TeamUpdraft says to look in the Plugins screen and its Must-Use tab (a second list WordPress hides by default), and in the site’s files, because some malicious plugins hide from the dashboard. Do not delete a suspect plugin from the dashboard. Deactivate it, then move the folder out of the website’s public folder rather than deleting it (TeamUpdraft says to remove the folder; Patchstack and Nethemba say move it, so the evidence survives). Do not try to repair a plugin that crashes the site: Patchstack says repairing it switches the backdoor onSource 2.
  4. Has someone listed every Administrator and Editor account, in a way that cannot be hidden? Some backdoors hide their account from the Users screen, so this has to be checked in the database or with the command line tool. Ask them to look for accounts you do not recognise. A clean user list does not prove a clean site: one variant creates no account, so the plugin check and the server logs matter as muchSource 1.
  5. Were passwords and session keys reset, after the backdoor was gone? Passwords for every legitimate admin and editor, the WordPress security keys that end all logged-in sessions, and the TeamUpdraft account password, plus the same password anywhere else you reused it. The TeamUpdraft password is safe to change at once, but do not log in to it from inside the site’s plugin until the site is clean: Nethemba found the plugin can keep that password.

If anything turns up, treat the site as compromised. TeamUpdraft suggests considering a restore from a clean backup taken before 17 October, with the keys revoked and credentials reset afterwards, because a restore alone does not stop the same key being used againSource 3. Keep the compromised copy for the investigation.

Here is a message you can paste and edit:
Hi, after the UpdraftCentral key compromise reported in October, could you confirm in writing: we have a full copy of the site (files, database, server logs); every UpdraftCentral key is deleted on our site; UpdraftPlus is on 1.26.13 / 2.26.13 or later; there are no unknown or hidden plugins; no unknown admin or editor accounts; all admin passwords and WordPress security keys have been reset; and the server logs were checked? Thanks.

Cutting the damage next time

Patchstack found one analysed site protected because the key belonged to an account without the right to install pluginsSource 2. Nethemba reports that a plugins folder the server could not write to also stopped installs on one site. A read-only folder also blocks your own updates, which then have to be done another way.

Patchstack advises not reconnecting until the vendor explains the cause; TeamUpdraft says it is fine once the site is secured. For one or two sites, doing without the dashboard costs little. Dates and version cut-offs shifted between updates; this post uses the latest figures we could read on 30 October. Check the vendor’s page before you act.

  1. A full copy of the site made before any clean-up Files, database and server logs.
  2. Every UpdraftCentral key deleted on the site itself Removing the site from the dashboard is not enough.
  3. UpdraftPlus on 1.26.13 / 2.26.13 or later
  4. No unknown or hidden plugins Deactivate suspects and move the folder out; do not delete from the dashboard or repair a crashing one.
  5. No unknown Administrator or Editor accounts Checked in the database, not only the Users screen.
  6. Passwords and WordPress security keys reset after the clean-up Including the TeamUpdraft account password and any reused one.
  7. A clean backup older than 17 October known to exist Restore only after keys are deleted and credentials reset.

Sources

  1. Nethemba: Critical security problem in UpdraftCentral (19 Oct 2026, updated to 26 Oct). Retrieved . ↩ ↩ ↩ ↩ ↩ ↩ ↩
  2. Patchstack: Stolen UpdraftCentral Keys Are Backdooring WordPress Sites (19 Oct 2026). Retrieved . ↩ ↩ ↩ ↩ ↩ ↩
  3. TeamUpdraft: Security incident, October 2026 (vendor advisory, updated to 29 Oct 2026). Retrieved . ↩ ↩ ↩ ↩
  4. BleepingComputer: Stolen UpdraftCentral keys used to backdoor WordPress sites (20 Oct 2026). Retrieved . ↩

Published · Updated Report an error (support@agentum.cloud)