October 27, 2026 6 min read Security

UpdraftCentral key theft and Rank Math PRO backdoor: check your site

Q: Is the free Rank Math SEO plugin affected?

No. Rank Math says only Rank Math PRO 3.0.123 copies downloaded between 20:02 UTC on 15 October and 07:12 UTC on 16 October 2026 were affected. The free plugin from WordPress.org needs no action.

Update UpdraftPlus, delete UpdraftCentral cloud keys, check for backdoors, and treat sites that activated 15–16 Oct Rank Math PRO 3.0.123 as compromised.

UB Web Developers team

Your WordPress site is at risk if it holds an UpdraftCentral cloud connection key, or if it activated a copy of Rank Math PRO 3.0.123 downloaded between 20:02 UTC on 15 October and 07:12 UTC on 16 October 2026. Updating is not enough: delete UpdraftCentral keys and check for accounts and plugins you didn't add, and treat a site that activated the bad Rank Math copy as compromised.

These are two separate incidents, and neither is a flaw in WordPress itself.

What happened with UpdraftCentral?#

TeamUpdraft, the company behind the UpdraftPlus backup plugin, found unauthorised access to teamupdraft.com over the weekend of 17–18 October and believes its customer database was accessed (opens in new tab). That database held hashed passwords, two-factor settings and the connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. UpdraftCentral lets you manage many sites from one dashboard, so a stolen key can send commands to a site.

Patchstack found (opens in new tab) that the commands were signed with real keys, so the sites accepted them. It counted 99 different backdoor plugin names, many made to look like maintenance tools, such as "Site Health Cache". The backdoor adds a hidden account that shows as an Editor, not an administrator, and logs in without the login form, so two-factor plugins never run.

Patchstack's monitoring saw these installs from 15:32 UTC on 18 October (opens in new tab) to 09:23 on 19 October. That is not when the attack ended: Nethemba (opens in new tab) logged new attacker commands on 21 October.

BleepingComputer estimates (opens in new tab) that about 10% of UpdraftPlus sites hold an UpdraftCentral or Migrator key, around 400,000 sites. That is how many could be exposed, not how many were hacked.

What happened with Rank Math PRO?#

Rank Math says (opens in new tab) some copies of Rank Math PRO 3.0.123 downloaded between 20:02 UTC on 15 October and 07:12 UTC on 16 October 2026 carried malware. Once the plugin is activated, the malware keeps access to the site, rebuilds its backdoor when someone visits, and can read every password and API key the site can. The issue is tracked as CVE-2026-111862 (opens in new tab), rated 9.8 out of 10.

The free Rank Math SEO plugin from WordPress.org is not affected.

Does this affect my site?#

Does the site hold an UpdraftCentral key? In the site's own admin, open Settings > UpdraftPlus > Advanced Tools > UpdraftCentral. If a key is listed, the site is exposed. You may have one without knowing: Patchstack found (opens in new tab) that the box that adds a site to UpdraftCentral is ticked by default when you connect a teamupdraft.com account, and keys don't expire. If you've already updated, an empty list doesn't clear the site, because the update deletes older keys itself (opens in new tab).
Do you have UpdraftPlus Premium? TeamUpdraft asks (opens in new tab) Premium users to check their sites for unusual activity even if they never used UpdraftCentral.
Do you run Rank Math PRO 3.0.123? Only copies from the window are affected, so the version number alone proves nothing. If you activated a copy from the window, Rank Math says (opens in new tab) to treat the site as compromised. If you installed it but never activated it, delete it, install 3.0.124 and run a scan. If you only downloaded it, there is no sign of compromise from this incident alone.

TeamUpdraft says (opens in new tab) free UpdraftPlus users who never created a teamupdraft.com account don't need to take any action. Self-hosted UpdraftCentral is not affected.

Is there a fix yet?#

Status, updated 23 October 2026. Yes, for both, but neither fix cleans a site that was already hit.

Early reports disagreed because the status changed on 19 October. At 08:00 UTC, Patchstack wrote (opens in new tab) that "no vendor fix exists"; later that day, UpdraftPlus 1.26.12 tried to revoke old keys, but a bug meant it deleted none (opens in new tab). UpdraftPlus 1.26.13 (opens in new tab) (free) and 2.26.13 (Premium) fixed that just after 22:00 BST on 19 October. TeamUpdraft says (opens in new tab) they disconnect every connection made before 13:07 BST (12:07 UTC) on 18 October, and Nethemba's reading of the code agrees. That is earlier than the 22:00 BST cutoff in TeamUpdraft's first statement, Nethemba notes, so keys created on 18 October between 12:07 and 21:00 UTC stay in place. Delete your key by hand even after updating.

For Rank Math, the clean version, 3.0.124, came out on 16 October and is still the latest (opens in new tab).

What should I do today?#

Do this today

Update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or later (TeamUpdraft (opens in new tab)). Skip 1.26.12 (Nethemba (opens in new tab)).
Delete every UpdraftCentral key under Settings > UpdraftPlus > Advanced Tools > UpdraftCentral (TeamUpdraft (opens in new tab)). Removing the site from the dashboard is not enough (Patchstack (opens in new tab)).
Reconnect only if you need to, with an account that can't install plugins, as Patchstack advises (opens in new tab).
Check Users for every account you don't recognise (TeamUpdraft (opens in new tab)), Editors included (Patchstack (opens in new tab)). Rank Math lists (opens in new tab) admin accounts named "wpsupport_" plus random characters.
Check Plugins, including the Must-Use tab, for anything you didn't install (TeamUpdraft (opens in new tab)), especially names that sound like maintenance or cache tools (Patchstack (opens in new tab)).
Have your host or developer remove any cron job or WordPress scheduled event nobody can explain. One backdoor schedules its own daily cron task (Nethemba (opens in new tab)).
Change every admin password (TeamUpdraft (opens in new tab)), then log out all sessions (Patchstack (opens in new tab)).
If an UpdraftCentral site shows anything wrong, restore files and database from a backup taken before 17 October, as TeamUpdraft advises (opens in new tab). Then change database passwords, API keys and WordPress salts: that step is our advice, based on the rotation Rank Math (opens in new tab) calls essential after its own incident.

If you have a teamupdraft.com account, even with no key on any site:

Change its password, typing the address yourself, and change that password wherever else you used it (TeamUpdraft (opens in new tab)).
Reset two-factor authentication in My Account if you use it there (TeamUpdraft (opens in new tab)).

If a site activated the affected Rank Math PRO copy, Rank Math says (opens in new tab) to treat it as compromised, even if nothing looks wrong, and to recover in this order:

Restore files and database from a backup made before 20:02 UTC on 15 October, then scan the site (Rank Math (opens in new tab)). With no clean backup, follow Rank Math's manual clean-up steps in the order it gives.
Change every password and key the site uses, from admin and database passwords to WordPress salts, API keys and hosting logins. Rank Math calls this essential (opens in new tab) even after a restore.
Install 3.0.124, downloaded after logging in at rankmath.com. Rank Math never emails (opens in new tab) download links.
Before calling the site clean, check core and plugin files against clean copies, and watch for removed files coming back (Rank Math (opens in new tab)).

Can a free scan find these backdoors?#

No. Our free tool can check your site's basics, but it reads only what any visitor sees. It can't look at your plugins, users or files, so it can't detect a backdoor plugin. Use the checks above or a malware scanner that runs inside WordPress.

Why do plugins carry this risk?#

Every plugin is code from another company that runs with full access to your site, so a breach at that company reaches its customers. In 2025, 91% of new WordPress vulnerabilities (opens in new tab) were in plugins.

A site without a plugin marketplace has fewer such companies, so this route is narrower, but not closed: custom sites depend on code libraries too. In September 2025, attackers phished an npm maintainer (opens in new tab) and published malicious versions of widely used JavaScript packages.

What we don't know yet#

How the attacker got the key that TeamUpdraft says (opens in new tab) was used to get into its site. TeamUpdraft says the extent "is unknown" and that there's no current evidence the attacker still has access to it.
How many sites were backdoored through UpdraftCentral. Patchstack's count of 99 plugin names comes from its own monitoring, which sees plugin installs but not every account created.
How the Rank Math PRO download was compromised and how many sites installed it. Rank Math did not answer BleepingComputer (opens in new tab) on either point.

Sources#

Security incident, October 2026 (opens in new tab), TeamUpdraft, 19 October 2026, last updated 23 October 2026
UpdraftCentral key compromise used to backdoor WordPress sites (opens in new tab), Patchstack, 19 October 2026
UpdraftCentral backdoor analysis (opens in new tab), Nethemba, 19 October 2026, last updated 23 October 2026
UpdraftPlus changelog (opens in new tab), WordPress.org, checked 23 October 2026
Stolen UpdraftCentral keys used to backdoor WordPress sites (opens in new tab), BleepingComputer, 20 October 2026
WordPress sites compromised after TeamUpdraft credential exposure (opens in new tab), CSO Online, 21 October 2026
Rank Math PRO 3.0.123 security incident (opens in new tab), Rank Math, checked 23 October 2026
Rank Math PRO changelog (opens in new tab), Rank Math, checked 23 October 2026
CVE-2026-111862 (opens in new tab), CVE record (CNA: Wordfence), 19 October 2026
WordPress SEO plugin Rank Math compromised to backdoor websites (opens in new tab), BleepingComputer, 19 October 2026
Hackers hijack npm packages with 2 billion weekly downloads in supply chain attack (opens in new tab), BleepingComputer, 8 September 2025
State of WordPress Security in 2026 (opens in new tab), Patchstack, 25 February 2026

Frequently asked questions#

Is the free Rank Math SEO plugin affected?#

No. Rank Math says (opens in new tab) only Rank Math PRO 3.0.123 copies downloaded between 20:02 UTC on 15 October and 07:12 UTC on 16 October 2026 were affected. The free plugin from WordPress.org needs no action.

I use the free UpdraftPlus. Do I need to do anything?#

Yes, if you have a teamupdraft.com account. TeamUpdraft says (opens in new tab) free users without one don't need to take any action. Account holders should change the account password, change it anywhere else they used it, and reset two-factor authentication if they use it there, whether or not a site holds a key today. On each site, update to 1.26.13 or later and delete any key under Settings > UpdraftPlus > Advanced Tools > UpdraftCentral. An empty list doesn't prove the site was never exposed, because the update deletes older keys itself, so check Users and Plugins as well.

Does updating UpdraftPlus or Rank Math remove a backdoor?#

No. Updating leaves behind any plugins, accounts, files and scheduled tasks the attacker added, and the attacker can keep using keys the update didn't remove: Nethemba (opens in new tab) saw new commands after the UpdraftPlus fix shipped. Access can continue until you delete those keys, remove the attacker's changes or restore a backup taken before the attack, and change the site's passwords. A site that activated the affected Rank Math copy needs Rank Math's full recovery steps (opens in new tab).

Are my UpdraftPlus backups safe?#

TeamUpdraft says backups stored in your own Google Drive, Dropbox or Amazon S3 were not affected. If your site was accessed through UpdraftCentral, re-authorise that storage and change its access keys as a precaution.

Can an online security scan tell me if my site has one of these backdoors?#

Not an outside scan like ours. It reads only what a visitor sees, so it can't list your plugins or users. Check them in your dashboard, or run a malware scanner inside WordPress.