WordPress backdoors: Rank Math PRO and UpdraftCentral

Between October 15 and 18, two attacks on plugin vendors installed malicious code on WordPress sites: a tampered version of Rank Math PRO and stolen UpdraftCentral keys. How to check your site.

In less than a week, two vendors of widely used WordPress plugins were attacked, and their own update channels ended up installing backdoors on their customers' sites. It was not a flaw in WordPress code: the attackers broke into the vendors' infrastructure.

Rank Math PRO 3.0.123

Copies of Rank Math PRO 3.0.123 downloaded or auto-updated between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malicious code. The case was registered as CVE-2026-111862, with a severity of 9.8 out of 10, and was fixed in version 3.0.124. The free version in the WordPress.org directory was not affected, and Rank Math said the incident reached a limited number of PRO users.

Most importantly: if your site installed that version during the window, consider it compromised. According to Rank Math, deactivating the plugin is not enough, because the malicious code can recreate its backdoor whenever someone visits the site: you need to delete the rank-math-pro folder and clean or restore the site. The indicators it published include connections to the rank1cdn.com domain, administrator accounts whose names start with wpsupport_ and the wp-includes/class-wp-cache-util.php file.

UpdraftCentral: stolen keys

TeamUpdraft, the maker of the UpdraftPlus backup plugin, detected unauthorized access to teamupdraft.com over the weekend of October 17 and 18, and believes its customer database was accessed. It held the connection keys for UpdraftCentral, the console used to manage several sites at once, as well as the UpdraftVault and UpdraftClone keys. With the UpdraftCentral keys, the attackers sent signed commands to connected sites to install malicious plugins: Patchstack counted at least 99 different names, such as "Site Health Cache", and some of them create editor accounts with administrator permissions.

UpdraftPlus versions 1.26.13 (free) and 2.26.13 (premium), released on October 19, disconnect UpdraftCentral connections created before 13:07 UK time on October 18. But updating does not remove a backdoor that is already installed.

How to check your WordPress site

Update Rank Math PRO to 3.0.124 and UpdraftPlus to 1.26.13 or 2.26.13, or later.
Review the plugin list and remove any you do not recognize, even if their names look technical.
Review administrator and editor users, and delete accounts nobody created on purpose.
In UpdraftCentral, delete old connection keys and generate new ones.
Change the admin, database and hosting passwords, and turn on two-factor authentication.
If the site was exposed, restore a backup taken before October 15 and reapply the updates.

The lesson

Premium plugins are downloaded outside the WordPress.org directory, straight from the vendor: if the vendor's infrastructure falls, the automatic update carries the attack to your site. That is why automatic updates should go hand in hand with monitoring and backups stored outside the site.

October 31 update: Rank Math and TeamUpdraft notices

We checked this article against the official Rank Math and TeamUpdraft notices. We replaced the "several hundred customers" figure, which the company only gave to a media outlet, with what its public notice says, and added its cleanup instructions and the other keys TeamUpdraft confirms were exposed.

How we help you

With our website maintenance plan we review plugins and users, apply updates after taking a backup and keep an eye on your site's security. If you think your site was affected, write to us for a review.