---
title: 'Stolen UpdraftCentral keys used to install backdoors on WordPress sites'
url: 'https://securteksecurity.com/news/stolen-updraftcentral-keys-backdoor-wordpress-sites'
markdown: 'https://securteksecurity.com/news/stolen-updraftcentral-keys-backdoor-wordpress-sites.md'
date: '2026-10-19'
description: 'TeamUpdraft disclosed unauthorized access to teamupdraft.com over October 17 to 18, 2026 and says it believes its customer database was accessed, containing customer names, emails, billing addresses, order histories, password hashes, two factor settings and connection keys for UpdraftCentral, Updra…'
taxonomy:
  category:
    - Cybersecurity
---

# [Stolen UpdraftCentral keys used to install backdoors on WordPress sites](https://securteksecurity.com/news/stolen-updraftcentral-keys-backdoor-wordpress-sites)

   19th Oct 2026  

TeamUpdraft disclosed unauthorized access to teamupdraft.com over October 17 to 18, 2026 and says it believes its customer database was accessed, containing customer names, emails, billing addresses, order histories, password hashes, two factor settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. Patchstack telemetry recorded attackers using genuine stolen UpdraftCentral dashboard keys to install backdoor plugins on connected WordPress sites continuously from October 18 at 15:32 UTC to October 19 at 09:23 UTC, under 99 distinct plugin names, all carrying the description "Small maintenance toolkit: keeps option storage tidy". The backdoor creates a disguised Editor account with manage\_options and install\_plugins capability and a persistent cookie that survives plugin removal. UpdraftPlus has more than 4 million active installs; exposure is sites with an active UpdraftCentral key, which can exist by default from a pre ticked account connection checkbox.

Nethemba, which discovered the campaign on its own sites, found that the first revocation release, 1.26.12, did not delete keys; release 1.26.13 deletes keys created before October 18 at 12:07 UTC, while keys created between 12:07 and 21:00 UTC that day must be deleted manually. Site owners should delete UpdraftCentral keys, check for the plugin description and the disguised Editor account, and treat a triggered backdoor as a full compromise. There is no vulnerability in UpdraftPlus itself in this campaign; the commands were correctly signed with genuine dashboard keys.

Sources: [Patchstack](https://patchstack.com/articles/updraftcentral-key-compromise-wordpress-backdoors/); [RuntimeWire](https://runtimewire.com/article/teamupdraft-updraftcentral-stolen-keys-wordpress-backdoors)

---

## Navigation

- Parent: [News](https://securteksecurity.com/news.md)
- Previous: [SpaceX Q3: AI segment reaches $7.56B and overtakes Starlink as company turns profitable](https://securteksecurity.com/news/spacex-q3-ai-segment-7-56b-overtakes-starlink.md)
- Next: [Stripe Link agent purchases rose 38-fold in September, Upstarts Media reports](https://securteksecurity.com/news/stripe-link-agent-purchases-38-fold-september.md)