Rank Math PRO and UpdraftPlus: Two WordPress Supply Chain Attacks and What to Check Now

Within a few days in October 2026, two widely used WordPress plugins were turned against the sites that trusted them. A tampered build of Rank Math PRO was delivered through the vendor’s own update channel, and stolen UpdraftCentral connection keys were used to push backdoors into sites running UpdraftPlus. In both cases site owners did nothing wrong: they installed updates or used a remote management feature, exactly as recommended.

This guide explains what happened, how to check whether your website is affected, and what these incidents teach small businesses about plugins.

The two incidents at a glance

Rank Math PRO: malware in an official update

Rank Math is one of the most popular SEO plugins for WordPress; its free version runs on more than 4 million sites, according to BleepingComputer. On October 15–16, 2026, for about 11 hours, some downloads of the paid Rank Math PRO 3.0.123 from the vendor’s own channel contained malware. Rank Math says the free version on WordPress.org was not affected, and it has not said how the attackers got in.

According to the vendor, if the plugin was activated, the malware could take over the site, recreate a hidden backdoor whenever someone visited a page, contact the domain rank1cdn.com and expose database credentials, API keys and other secrets. Security databases list the incident as CVE-2026-111862 with a CVSS score of 9.8 out of 10.

Are you affected?

Check the Rank Math PRO version under Plugins and, if possible, when it was installed or updated. Rank Math’s own guidance distinguishes three cases:

• 3.0.123 installed and activated during the window: treat the website as compromised and follow the recovery steps below.
• 3.0.123 installed but never activated: delete the plugin files, install 3.0.124 and run a security scan as a precaution.
• Downloaded but never installed: no sign of compromise from this incident alone.

Signs of compromise to look for

From Rank Math’s official incident notice:

• administrator accounts whose username starts with wpsupport_, or admin email addresses ending in @wp-mail.net
• a fake core file at wp-includes/class-wp-cache-util.php
• database options named _uf6qdn2hmm, t8krdk990phb or _np5pvf754c in the wp_options table
• .htaccess rules that let .cache files run as PHP, and PHP files inside wp-content/uploads/ or wp-content/mu-plugins/
• scheduled tasks (cron) marked #ms6v46, and outbound connections to rank1cdn.com

How to recover

Rank Math recommends restoring the website and database from a backup made before October 15, 2026, 20:02 UTC, then scanning the site, changing every password, database credential and API key, and only then installing 3.0.124. If no clean backup exists, the order of a manual cleanup matters: first delete the whole rank-math-pro folder (deactivating it is not enough) and the three database options so the malware cannot rebuild itself, then hunt for the other changes, then rotate all credentials. This is a job for your developer or host.

UpdraftPlus: stolen keys used to install backdoors

UpdraftPlus is one of the most widely used WordPress backup plugins. Its optional UpdraftCentral service lets agencies manage many sites from one dashboard using a connection key stored on each site. Over the weekend of October 17–18, 2026, TeamUpdraft detected unauthorised access to teamupdraft.com and believes the attacker reached its customer database, including password hashes, two-factor settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. Payment card details were not stored there, and the plugin downloads themselves were not affected.

The keys were abused quickly. Patchstack reported attacks starting on October 18 and logged at least 99 different malicious plugins disguised as maintenance tools, for example “Site Health Cache”, which could run code and add administrator accounts. BleepingComputer estimates that about 10% of UpdraftPlus sites have such a key, potentially around 400,000 websites.

What to do if you use UpdraftPlus

1. Log in to the site’s own WordPress dashboard directly, not through UpdraftCentral.
2. Update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or later. The earlier 1.26.12 and 2.26.12 releases did not remove the keys because of a bug.
3. Delete every key under Settings > UpdraftPlus Backups > Advanced Tools > UpdraftCentral > Manage existing keys, even after updating. Removing the site from the UpdraftCentral dashboard is not enough.
4. Check Users for unfamiliar administrators or editors, and Plugins, including the Must-Use tab, for anything you do not recognise.
5. If you have a teamupdraft.com account, change its password, change it anywhere you reused it, and reset two-factor authentication.
6. If you find signs of compromise, restore a backup made before October 17, 2026, reset all administrator passwords, log out all sessions and rotate the keys for your remote backup storage.

If you use the free plugin without a teamupdraft.com account or an UpdraftCentral key, keeping UpdraftPlus updated is enough.

What these attacks teach small businesses

Both incidents abused trust rather than a mistake by the site owner. That is why a few habits matter more than any single plugin:

• Keep fewer plugins. Every plugin, and every service connected to your site, is another company you trust with full control of your website. Remove what you do not use.
• Keep off-site backups you control, with several restore points. Both vendors’ first recommendation was to restore a backup from before the incident; that only works if you have one.
• Know what is installed and when it changed. A simple list of plugins, versions and update dates turns “are we affected?” into a two-minute question.
• Use two-factor authentication for every administrator and review the list of administrator accounts regularly. New, unexplained admins were a sign in both incidents.
• Disconnect remote management you no longer use. An old connection key for a service you tried once is still a way into your site.
• Update quickly, but follow the incident notice. In both cases the update alone did not remove what attackers had already planted.

These attacks came days after another urgent issue for WordPress sites, the PHP2Shell vulnerability in PHP itself. If you have not checked your PHP version yet, do that too.

Firms covered by the FTC Safeguards Rule

Tax preparers, mortgage brokers and other firms covered by the FTC Safeguards Rule must oversee their service providers (16 CFR 314.4(f)), and a plugin vendor with code running on your site is one of them. If customer information may have been accessed, the FTC notification duty in 314.4(j) can apply. Record what you checked, when and with whom; see our guides for tax preparers and mortgage brokers.

How Nyorsoft can help

Our reviews look at your website from the outside, the way an attacker first sees it: publicly visible software and versions, exposed admin and login pages, leftover files, security headers and your email domain. Prices are fixed and everything happens by email, without access to your systems. An outside review cannot see files or accounts inside your WordPress installation, so it does not replace the checks above; it shows what you expose to everyone else. Start with our free security check or see services and pricing.

Sources

• Rank Math: PRO 3.0.123 Security Incident – How to Secure Your Website
• SecurityWeek: Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack
• BleepingComputer: WordPress SEO plugin Rank Math compromised to backdoor websites
• FreshySites: CVE-2026-111862 security bulletin
• BleepingComputer: Stolen UpdraftCentral keys used to backdoor WordPress sites
• InMotion Hosting: UpdraftCentral Connection Key Compromise – What WordPress Site Owners Should Do Now

This article summarises vendor notices and security reporting as of October 25, 2026. Investigations are ongoing; always check the vendors’ own notices for the latest guidance.

Written byPavol Huňor · IT Analyst, Nyorsoft

Pavol brings IT analysis experience from banking and financial-sector projects to Nyorsoft’s external security reviews for small businesses. About our team