SOLUTIONSQuick answer
Two popular WordPress plugin vendors were breached in October 2026. Rank Math PRO 3.0.123 downloaded between 15 October 20:02 UTC and 16 October 07:12 UTC contained a backdoor; activated sites should be treated as compromised. TeamUpdraft's customer database and UpdraftCentral keys were accessed; update UpdraftPlus to 1.26.13 or 2.26.13 and check for unknown users.
Key takeaways
- Only the paid Rank Math PRO plugin, version 3.0.123, downloaded in a roughly 11-hour window, is affected. The free Rank Math SEO plugin on WordPress.org is not.
- Updating to Rank Math PRO 3.0.124 does not remove the backdoor; Rank Math recommends restoring a backup from before the window.
- TeamUpdraft says attackers used UpdraftCentral connection keys to create admin accounts and install malicious plugins on customer sites.
- UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) disconnect older UpdraftCentral connections; the plugin downloads themselves were not tampered with.
- In both cases, rotate every password and key the site could read, not just WordPress logins.
What happened to Rank Math PRO and UpdraftPlus?
Both incidents are supply chain attacks: instead of breaking into websites one by one, attackers compromised a trusted vendor and used it to reach that vendor's customers. Your site could be affected even if your own passwords and updates were in perfect order.
- Rank Math PRO: copies of version 3.0.123 downloaded or auto-updated between 15 October 2026, 20:02 UTC and 16 October 2026, 07:12 UTC contained malware. Rank Math removed the files and released 3.0.124 on 16 October. The flaw is tracked as CVE-2026-111862, which Wordfence rates 9.8 out of 10, according to The Hacker News.
- UpdraftPlus / TeamUpdraft: on 17–18 October, TeamUpdraft found unauthorised access to teamupdraft.com. It believes its customer database was accessed, including names, emails, billing addresses, hashed passwords, two-factor settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. Attackers used UpdraftCentral connections to create admin accounts and install malicious plugins on some sites.
Neither vendor has said how many sites were affected, and Rank Math has not said how the malicious files got into its download system.
Is my site affected by the Rank Math PRO backdoor?
Check the version on the Plugins page and when it was installed. Rank Math's own notice splits customers into three groups:
| Your situation | Risk | What to do |
|---|---|---|
| 3.0.123 installed and activated during the window | Treat the site as compromised | Restore a site and database backup from before 15 Oct 20:02 UTC, then rotate credentials |
| 3.0.123 installed during the window but never activated | Lower | Delete the plugin folder, install 3.0.124 from your Rank Math account, run a security scan |
| Downloaded during the window but never installed | No sign of compromise from this incident alone | Delete the file; contact Rank Math support if unsure |
| Free Rank Math SEO from WordPress.org | Not affected | No plugin action needed |
How do I clean up after the Rank Math PRO backdoor?
The safest route is a full restore of files and database from a backup taken before 20:02 UTC on 15 October. If you have no clean backup, the steps published by Rank Math and summarised by The Hacker News are, in order:
- Delete the entire
rank-math-proplugin folder over FTP, SFTP or your host's file manager. - Delete the
wp_optionsentries named_uf6qdn2hmm,t8krdk990phband_np5pvf754c. - Block outgoing connections to
rank1cdn[.]comif your host or firewall allows it. - Look for the other indicators below, then install 3.0.124 by logging in at rankmath.com directly. Rank Math says it never emails login or download links.
Warning signs reported for this incident include:
- Administrator accounts whose usernames start with
wpsupport_, or emails ending@wp-mail[.]net. - A file at
wp-includes/class-wp-cache-util.php, which is not part of WordPress core. - Unfamiliar PHP files in
wp-content/mu-plugins/,uploads/, other plugins' folders or themeinc/,includes/andlib/folders. .htaccessrules that let.cachefiles run as PHP, crontab entries tagged#ms6v46, and new SSH keys inauthorized_keys.
What should UpdraftPlus users do?
TeamUpdraft says the UpdraftPlus plugin and its downloads were not affected, and backups in your own remote storage are safe. Card details were not stored. What matters is whether you have a teamupdraft.com account and used its cloud services.
- Free UpdraftPlus users without a teamupdraft.com account: no action required beyond keeping the plugin updated.
- All teamupdraft.com account holders: change your password (type the address yourself rather than clicking an email link), change it anywhere you reused it, and reset two-factor authentication.
- UpdraftCentral (cloud) users: log in to each site's own dashboard, update UpdraftPlus to 1.26.13 / 2.26.13 or later, delete the UpdraftCentral connection key, remove unknown administrator or editor accounts and unknown plugins (including Must-Use plugins), change admin passwords, then reconnect and re-authorise remote storage.
- UpdraftVault users: all sites were disconnected; reconnect each one and run a manual backup to confirm it works.
- UpdraftClone users: old client keys were replaced and no longer work; share the new keys with your clients.
- Premium users: TeamUpdraft asks you to check your sites for unusual activity even if you never used UpdraftCentral.
If anything looks wrong, TeamUpdraft suggests restoring from a backup taken before 17 October.
Which passwords and keys should I change?
If either incident touched your site, assume anything the site could read was exposed. Even after a clean restore, change:
- All WordPress administrator passwords, with two-factor authentication turned on.
- The database password and the security keys and salts in
wp-config.php. - Payment gateway, SMTP and other API keys stored in plugins or settings.
- Hosting control panel, FTP, SFTP and SSH access.
- Cloud storage keys used for backups (Google Drive, Dropbox, Amazon S3).
Then verify WordPress core with wp core verify-checksums and free plugins with wp plugin verify-checksums --all. Premium plugins usually have no public checksums, so compare against a fresh copy from the vendor's site.
How can I reduce the risk from plugin supply chain attacks?
October's incidents, along with earlier 2026 cases The Hacker News lists involving other premium plugin update channels, show that a trusted update can be the attack. You cannot prevent a vendor breach, but you can limit the damage:
- Keep daily off-site backups with several weeks of history, and test a restore. A clean backup was the first recommendation in both incidents.
- Remove plugins you do not use, and prefer fewer, well-maintained ones.
- Review admin and editor accounts regularly; unexpected users were a key sign in both cases.
- For important sites, apply premium plugin updates on a staging copy first, or wait a short period unless the update is a security fix.
- Store secrets so the website only has access to what it needs, and know where every key lives so you can rotate it quickly.
Need a hand? Naarvix can check a WordPress site for these indicators, restore it safely and set up backups and update routines, for clients anywhere in the world. See our web development service or contact us. The same lesson applied to PHP2Shell earlier this month.
Sources
Frequently asked questions
Is the free Rank Math SEO plugin affected?
No. Rank Math says the free plugin on WordPress.org is not affected. Only Rank Math PRO 3.0.123 downloaded between 15 October 20:02 UTC and 16 October 07:12 UTC contained the malware.
Does updating to Rank Math PRO 3.0.124 fix my site?
Not on its own. If 3.0.123 was activated during the affected window, the malware may have planted files, accounts and scheduled tasks elsewhere. Restore a backup from before the window or follow the manual cleanup, then rotate credentials.
Were UpdraftPlus backups stolen?
TeamUpdraft says backups stored in your own remote storage are not affected and the plugin downloads were not tampered with. Its customer database and cloud connection keys were accessed, so update the plugin, reconnect services and re-authorise storage.