[{"data":1,"prerenderedAt":240},["ShallowReactive",2],{"seo-verification":3,"blog-updraftcentral-stolen-keys-wordpress-backdoors-clean-restore-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-updraftcentral-stolen-keys-wordpress-backdoors-clean-restore-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":33,"intro":36,"sections":37,"ctaTitle":186,"ctaBody":187,"ctaButton":188,"ctaUrl":189,"relatedPosts":190},535,"updraftcentral-stolen-keys-wordpress-backdoors-clean-restore",{"fr":12,"en":10,"ar":13,"es":14},"updraftcentral-cles-volees-backdoors-wordpress-sauvegarde","updraftcentral-مفاتيح-مسروقة-أبواب-خلفية-ووردبريس-استعادة-نظيفة","updraftcentral-claves-robadas-puertas-traseras-wordpress-restaurar","UpdraftCentral: stolen keys, fake plugins, a clean restore","Stolen UpdraftCentral keys led to fake plugins on WordPress sites: revoke the keys, audit plugins and admin accounts, then restore from a clean backup.",9,0,false,"2026-10-30T00:00:00+00:00","2026-10-31T01:54:05+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fupdraftcentral-cles-volees-backdoors-wordpress-sauvegarde-poster.svg",{"categorySlug":34,"appSlug":35},"cms-websites","wordpress","On 17 and 18 October 2026, unauthorised access to the UpdraftPlus vendor's own website exposed UpdraftCentral connection keys, and WordPress sites then received fake plugins without any plugin vulnerability being involved. For an agency running a portfolio of client sites, updating is no longer the whole question: you need to know which sites were already hit, which keys are still valid and which accounts were created in the shadows. This guide gives the commands to check, revoke, audit and restore, site by site.",[38,42,77,80,91,118,149,152,173,177,180,183],{"type":39,"title":40,"body":41},"h2","What happened at UpdraftPlus in October 2026","The vendor, TeamUpdraft, identified unauthorised access to its own website on 17 and 18 October 2026. The data involved includes UpdraftCentral connection keys, the remote management service. With such a key, an attacker signs commands that a site accepts as coming from its dashboard, including the installation of a plugin. Patchstack observed the first backdoor installation on 18 October at 15:32 UTC and counts at least 99 malicious plugins with distinct names, disguised as maintenance tools. The central point lies elsewhere: this is not a flaw in the backup plugin. The vendor states that the plugin and its downloads are not affected, nor are backups kept in your own remote storage. The danger comes from a stolen remote management key, not from WordPress backups in general.",{"type":43,"title":44,"headers":45,"rows":49},"comparison","Versions and situations: where each site stands",[46,47,48],"Situation","Status","Action",[50,54,58,62,66,70,74],[51,52,53],"UpdraftPlus 1.26.13 (free) or 2.26.13 (Premium), or newer","Existing UpdraftCentral connections are revoked, according to the vendor","Still check keys, plugins and accounts",[55,56,57],"UpdraftPlus 1.26.12","According to Nethemba, a bug prevented the keys from being removed","Move to 1.26.13 or newer, then delete the keys",[59,60,61],"Older version","A key may remain valid","Update, then delete the keys",[63,64,65],"Plugin up to date, fake plugin already planted","The update does not remove the fake plugin","Audit plugins and accounts, see below",[67,68,69],"Site never connected to UpdraftCentral","No key expected","Read the keys option to be sure",[71,72,73],"Self-hosted UpdraftCentral","Not affected, according to the vendor","No action specific to this incident",[75,72,76],"Backups in your own remote storage","Re-authorise the storage and change its keys",{"type":39,"title":78,"body":79},"Why \"up to date\" does not mean \"clean\"","The sentence \"my plugin is up to date, I am covered\" is wrong for two reasons. First, version 1.26.12 was meant to remove the keys but, according to Nethemba as quoted by BleepingComputer, a bug prevented it: only 1.26.13 and 2.26.13 fixed that point. Second, an update changes the code of the backup plugin; it removes neither a fake plugin that is already installed nor an administrator account that already exists. The vendor has also reported, in an update to its notice, sites where a plugin dropped by the attacker survived the initial incident and later created a new administrator, even after disconnection. A site is therefore declared clean only after checking keys, plugins and accounts, never on the strength of a version number.",{"type":81,"title":82,"items":83},"ul","The signs to look for on each site",[84,85,86,87,88,89,90],"**An unknown plugin** — the name Site Health Cache comes up often according to Patchstack, but the list is not exhaustive: the vendor also names Asset Forge 2, Core Smith, Image Forge and WP Forge.","**A telltale description** — the string \"Small maintenance toolkit: keeps option storage tidy.\" is the most reliable file-level indicator according to Patchstack; not finding it proves nothing.","**A hidden account** — usernames such as data-ops43 or media-staff96, an example.org address, the display name Site Tools; some plugins hide these accounts from the Users screen.","**An option ending in `_sync_token`** — an entry whose name ends this way in the options table accompanies the backdoor.","**An install with no author** — a plugin that appeared without any administrator action, or a WordPress error email naming a plugin nobody knows.","**A key still present** — the `updraft_central_localkeys` option is not empty: the site stays exposed as long as that key exists.","**A log line** — in the UpdraftCentral log, `probe.central.updraftplus.com` followed by `Command received: plugin.upload_plugin`.",{"type":92,"title":93,"steps":94},"steps","Audit each site, in order",[95,98,101,103,106,109,112,115],{"title":96,"body":97},"Work from the site itself","Open the site's own WordPress dashboard, or an SSH session, but not UpdraftCentral: the vendor asks you to log in to each site directly.",{"title":99,"body":100},"Read the existing keys","`wp option get updraft_central_localkeys`\nNon-empty output means the site is exposed, according to Patchstack, even if you never used UpdraftCentral. An \"option does not exist\" error means no key is present.",{"title":61,"body":102},"`wp plugin update updraftplus`\n`wp option delete updraft_central_localkeys`\nThe graphical path is Settings > UpdraftPlus Backups > Advanced Tools > UpdraftCentral, then \"Manage existing keys\"; the exact label varies by version, so the command is the reference gesture. Removing the site from the UpdraftCentral dashboard is not enough. Backups keep working.",{"title":104,"body":105},"List the plugins and compare","`wp plugin list --fields=name,status,version`\n`ls wp-content\u002Fmu-plugins\u002F`\nCompare with the expected list for the portfolio: a plugin nobody approved is suspect, including in the Must-Use folder, which the Plugins screen does not always display.",{"title":107,"body":108},"Search for the fake plugin's signature","`grep -r \"Small maintenance toolkit: keeps option storage tidy.\" wp-content\u002Fplugins\u002F wp-content\u002Fmu-plugins\u002F`\nA hit is an alert. An empty search does not prove the site is clean.",{"title":110,"body":111},"List privileged accounts","`wp user list --role=administrator --skip-plugins`\n`wp user list --role=editor --skip-plugins`\nThe `--skip-plugins` option matters: it avoids loading the plugins that hide accounts on screen. Compare with the expected list of people who actually administer the site.",{"title":113,"body":114},"Look for the backdoor option","`wp option list --search=\"*_sync_token\"`\nAny entry found calls for the \"compromised site\" handling in the next section.",{"title":116,"body":117},"Record the result","One line per site: UpdraftPlus version, keys present or not, plugin gap, account gap, audit date, decision. This register serves as proof for the client and as a baseline for the next incident.",{"type":43,"title":119,"headers":120,"rows":124},"The same checks by environment",[121,122,123],"Environment","Typical command","Note",[125,129,133,137,141,145],[126,127,128],"Debian or Ubuntu","`sudo -u www-data wp --path=\u002Fvar\u002Fwww\u002Fhtml plugin list`","Adapt the path and the user to your installation",[130,131,132],"RHEL, AlmaLinux or Rocky","`sudo -u apache wp --path=\u002Fvar\u002Fwww\u002Fhtml plugin list`","User `nginx` if the web server is nginx",[134,135,136],"Docker Compose","`docker compose exec -u www-data wordpress wp plugin list`","The service name depends on your file; WP-CLI is often missing from the WordPress image, check",[138,139,140],"Shared hosting with SSH","`wp plugin list` from the site folder","Without SSH, use the file manager or SFTP",[142,143,144],"Without WP-CLI","Inspect `wp-content\u002Fplugins\u002F` and `wp-content\u002Fmu-plugins\u002F` over SFTP","Compare each folder with the expected list",[146,147,148],"All environments","`wp config shuffle-salts`","Changes the WordPress security keys and closes open sessions",{"type":39,"title":150,"body":151},"At the slightest sign, treat the site as compromised","If a backdoor account exists or the trigger appears in the logs, Patchstack recommends treating the site as fully compromised. The order matters. Delete the UpdraftCentral key first, otherwise the attacker keeps their way in. Then deactivate the fake plugin and remove its folder directly on the server: the vendor warns that some plugins are designed to erase their traces when deleted from the dashboard. Do not fix a code error in that plugin to \"repair\" it: Patchstack warns that this activates the backdoor. Remove the account and the `_sync_token` option, then prefer restoring over manual cleanup, because nothing proves that a hand cleanup found everything.",{"type":92,"title":153,"steps":154},"Restore cleanly",[155,158,161,164,167,170],{"title":156,"body":157},"Choose the restore point","Take a backup from before 17 October 2026 and check that it really predates the compromise: file dates, the last known plugin installation, server logs.",{"title":159,"body":160},"Restore outside production","Mount the backup on a test site or a disposable server, never directly in production. Re-run the audit section checks there: keys, plugins, accounts, signature.",{"title":162,"body":163},"Compare with a clean installation","`wp core verify-checksums`\n`wp plugin verify-checksums --all`\nThese commands compare core and plugin files with the checksums of the official directory; a modified file is reported.",{"title":165,"body":166},"Update before going back online","Move UpdraftPlus to 1.26.13 or 2.26.13 at the very least, update everything else, then delete the keys again: a backup from before the incident may contain some.",{"title":168,"body":169},"Return to production and monitor","Switch over the restored site, then re-read plugins and accounts over the following days. A plugin or account that reappears signals a door still open elsewhere.",{"title":171,"body":172},"Decide on reconnection","TeamUpdraft allows reconnecting to UpdraftCentral once the site is checked and secured. At the date of its article, Patchstack advised waiting for the cause to be explained. If you do not need remote management, leave it disconnected.",{"type":174,"title":175,"body":176},"tip","Restoring does not replace revoking","Restoring a clean backup does not exempt you from deleting the keys or changing credentials: the vendor says so itself. Always proceed in this order: keys deleted, passwords changed, sessions closed, then back online.",{"type":39,"title":178,"body":179},"Remote storage, sessions and passwords","Backups kept in your remote storage (Google Drive, Dropbox, Amazon S3) are not affected, according to the vendor, but sites reachable through UpdraftCentral must re-authorise that storage and change its access keys. Rotate the S3 keys, renew the authorisation for Drive or Dropbox accounts, then change the WordPress security keys with `wp config shuffle-salts` and the passwords of all legitimate administrator and editor accounts. On the vendor side, change your password by typing the address by hand in the browser, reset two-factor authentication, and if you use UpdraftVault, reconnect the storage and run a manual backup: the sites had been disconnected. The data exposed at the vendor includes names, email addresses, billing addresses and order history; passwords are stored there only in hashed form.",{"type":39,"title":181,"body":182},"For an agency: one inventory, not ten spreadsheets","Across dozens of sites, the time does not go into the command, it goes into the question \"who has what\". Keep a living register per site: UpdraftPlus version, presence of keys, expected plugin list, expected administrator list, date of the last audit, date of the last backup. Without a reference list, a plugin is never \"unknown\", only \"not yet seen\". Look at your restore points before you need them: at ServOrbit.com, backups are weekly on entry-level plans and daily on the Pro plan and on every Agency plan, and you should check that a copy from before 17 October 2026 still exists. Our guide on testing the restore of a client VPS backup describes the procedure to rehearse cold, and the update routine for a portfolio remains the one from the two recent WordPress alerts.",{"type":39,"title":184,"body":185},"Official documentation","TeamUpdraft notice on the October 2026 incident: https:\u002F\u002Fteamupdraft.com\u002Fblog\u002Fsecurity-incident-october-2026\u002F\n\nPatchstack analysis: https:\u002F\u002Fpatchstack.com\u002Farticles\u002Fupdraftcentral-key-compromise-wordpress-backdoors\u002F\n\nBleepingComputer article: https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fstolen-updraftcentral-keys-used-to-backdoor-wordpress-sites\u002F\n\nWP-CLI, user list: https:\u002F\u002Fdeveloper.wordpress.org\u002Fcli\u002Fcommands\u002Fuser\u002Flist\u002F\n\nWP-CLI, plugin checksum verification: https:\u002F\u002Fdeveloper.wordpress.org\u002Fcli\u002Fcommands\u002Fplugin\u002Fverify-checksums\u002F\n\nWP-CLI, security key rotation: https:\u002F\u002Fdeveloper.wordpress.org\u002Fcli\u002Fcommands\u002Fconfig\u002Fshuffle-salts\u002F","A portfolio of client sites to check, without multiplying logins","A portfolio of client sites needs a single inventory of plugins and access. With the ServOrbit.com agency space, you follow accounts, expiry dates and services from one interface: you manage the client relationship, we run the infrastructure.","Discover the agency offer","\u002Fsolutions\u002Fagences",[191,207,223],{"id":192,"slug":193,"slugs":194,"title":198,"excerpt":199,"readTime":200,"views":18,"isPinned":19,"publishedAt":201,"updatedAt":202,"category":203,"categories":204,"featuredImage":30,"bgImage":31,"posterImage":206,"relatedSolution":30},523,"test-client-vps-backup-restore-agency-procedure",{"fr":195,"en":193,"ar":196,"es":197},"tester-restauration-sauvegarde-vps-client-agence-procedure","اختبار-استعادة-نسخة-احتياطية-vps-عميل-وكالة-إجراء","probar-restauracion-copia-seguridad-vps-cliente-agencia-procedimiento","Testing a client backup restore: an agency procedure","A quarterly procedure to restore a client site on a disposable VPS, measure the actual RTO and RPO, and hand the client a dated restore test log.",11,"2026-10-28T00:00:00+00:00","2026-10-29T03:10:23+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[205],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Ftester-restauration-sauvegarde-vps-client-agence-procedure-poster.svg",{"id":208,"slug":209,"slugs":210,"title":214,"excerpt":215,"readTime":23,"views":18,"isPinned":19,"publishedAt":216,"updatedAt":217,"category":218,"categories":219,"featuredImage":30,"bgImage":31,"posterImage":221,"relatedSolution":222},373,"wordpress-cve-2026-87902-update-to-712-now",{"fr":211,"en":209,"ar":212,"es":213},"wordpress-cve-2026-87902-rce-mise-a-jour-7-1-2","ووردبريس-cve-2026-87902-ترقية-7-1-2","wordpress-cve-2026-87902-actualiza-a-712-urgente","WordPress CVE-2026-87902: Update to 7.1.2 Now","CVE-2026-87902 (CVSS 9.2) actively exploited since Sept. 22, 2026. Check your version, apply WordPress 7.1.2, and see why shared hosting extends exposure.","2026-09-24T00:00:00+00:00","2026-10-26T18:53:20+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[220],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fwordpress-cve-2026-87902-rce-mise-a-jour-7-1-2-poster.svg",{"categorySlug":34,"appSlug":35},{"id":224,"slug":225,"slugs":226,"title":230,"excerpt":231,"readTime":232,"views":18,"isPinned":19,"publishedAt":233,"updatedAt":234,"category":235,"categories":236,"featuredImage":30,"bgImage":31,"posterImage":238,"relatedSolution":239},525,"bricksforge-cve-2026-85097-wordpress-update",{"fr":227,"en":225,"ar":228,"es":229},"bricksforge-cve-2026-85097-wordpress-mettre-a-jour","ثغرة-bricksforge-cve-2026-85097-ووردبريس-التحديث","bricksforge-cve-2026-85097-wordpress-actualizar","Bricksforge CVE-2026-85097: update and audit your WordPress fleet","Bricksforge 3.1.8.10 fixes CVE-2026-85097, an exploited unauthenticated upload. wp-cli inventory, dropped PHP files, access logs, secrets to rotate.",10,"2026-10-29T00:00:00+00:00","2026-10-29T15:45:55+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[237],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fbricksforge-cve-2026-85097-wordpress-mettre-a-jour-poster.svg",{"categorySlug":34,"appSlug":35},1793414300349]