Backdoors on up-to-date WordPress sites: Rank Math PRO and stolen UpdraftCentral keys

Between 20:02 UTC on 15 October 2026 and 07:12 UTC on the 16th, some downloads and updates of Rank Math PRO from the vendor's website delivered a version 3.0.123 carrying malicious code. Rank Math's incident notice confirms the window, points customers to a clean 3.0.124 and tells them to treat any site that activated the affected package during that window as compromised. Wordfence, acting as a CVE Numbering Authority (CNA), assigned the case CVE-2026-111862, with a CVSS score of 9.8.

A few days later, in a separate incident, an attacker used UpdraftCentral remote-management keys, apparently stolen from TeamUpdraft's systems, to push backdoored plugins onto other people's websites. TeamUpdraft is the company, UpdraftPlus its backup plugin (1.x for the free edition, 2.x for Premium) and UpdraftCentral the console that manages those sites remotely.

Neither attack exploited an unpatched flaw on the affected sites. The security firm Nethemba found that its three sites targeted through UpdraftCentral ran WordPress 7.1.3 and UpdraftPlus 2.26.11, already patched for June's CVE-2026-10795. In each case the attacker exploited the trust a website places in whoever writes its plugins, and no public source has linked the two incidents.

What happened with Rank Math PRO 3.0.123?

The free edition of Rank Math, which reaches sites through the WordPress.org repository, was untouched, according to the vendor's notice of 16 October. Only the paid edition was hit, and that one downloads and updates from Rank Math's own infrastructure.

The legitimate 3.0.123 had been released on 7 October, according to Rank Math's changelog. The evidence suggests, according to The Repository, that during the window a tampered package replaced it under the same version number, and the CVE record points out that having 3.0.123 installed does not on its own prove compromise. Rank Math told the outlet, in an article published on 20 October, that the compromised version affected "several hundred customers", without explaining how the attacker got into its systems.

The notice describes persistence designed to outlast an obvious clean-up. The backdoor rebuilds itself whenever someone loads the site and may plant administrator accounts prefixed wpsupport_, a counterfeit core file at wp-includes/class-wp-cache-util.php and .htaccess rules that make cache-looking files execute as PHP.

Deactivating the plugin is not enough, and its whole folder has to be deleted. Rank Math also warns that the attacker may have made changes outside WordPress, asks customers to review authorised SSH keys and the web server user's crontab, and considers exposed every credential the site could reach. The malware's command-and-control (C2) domain, rank1cdn[.]com, was registered on 14 October, about 24 hours before the window, according to Verisign's RDAP record.

How were the UpdraftCentral keys used?

TeamUpdraft has confirmed unauthorised access to teamupdraft.com over the weekend of 17 and 18 October 2026, which it says has been resolved and has reported to the UK Information Commissioner's Office and other authorities. It believes the intruder reached the customer database. That database held names, email addresses, billing addresses and order history, as well as password hashes, two-factor settings and the connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. The plugin files and downloads were not affected.

Patchstack's analysis explains that the UpdraftCentral client is bundled with every copy of UpdraftPlus and stays inactive until the site is issued connection keys. After that, the site obeys signed commands from the dashboard, acting with the capabilities of the user who set up the link.

Keys carry no expiry, and Nethemba found ones created in November 2025 still accepted in October 2026. The box that adds a site to UpdraftCentral when it is linked to a TeamUpdraft account is still ticked by default while the site has no key, as Nethemba confirmed in the code of 2.26.11 and 1.26.13. Keys may therefore exist on sites whose owners never touched the dashboard.

Patchstack saw the first malicious install at 15:32 on 18 October, without stating a time zone, and catalogued 99 differently named backdoor plugins posing as maintenance tools, "Site Health Cache" among them. Early samples contained a coding error that crashed them before the backdoor logic ran, so many sites started returning HTTP 500. The site of the French outlet IT-Connect, running UpdraftPlus Premium 2.26.11, received the command at 05:17 UTC on 19 October, although the malicious plugin failed because of that error.

Nethemba and Wordfence also document a working variant with two modes. One creates a full administrator, the other logs in as the first existing administrator without creating an account or leaving a database trace. Wordfence says it can hide that administrator, while Nethemba found the hiding fails and the account shows up in the user list.

The founder of the maintenance firm NerdPress told The Repository that he found about 340 client sites holding keys. The backdoor had been installed on eight of them and on his own blog, and was removed before it could be exploited, and the keys used dated from 2018 to 2021.

Why didn't keeping current help?

Did UpdraftCentral have a vulnerability to patch?

UpdraftCentral has no CVE, and Patchstack classes the case as a compromise of keys, with no code defect on the site to correct. The usual cycle of disclosure followed by an update does not apply here, because Nethemba's sites accepted commands that carried valid signatures.

Why did the Rank Math risk lie in updating during the window?

Sites that already had the clean 3.0.123 probably did not download it again, because the updater only offers versions newer than the one installed, although no source has confirmed this. The risk fell on new installs, reinstalls or manual downloads, and sites updating from an older version during the window.

A policy of waiting a few days after each release does not protect against this either, because 3.0.123 had been out for eight days when it was tampered with and any site installing it during the window received it all the same. What would have caught the change is an integrity check of the package against a hash the vendor publishes through a separate channel, and Wordfence notes that such checksums are not available for every premium plugin.

Why did multi-factor authentication not stop the backdoor?

By design, the backdoor Patchstack described creates an Editor account with the manage_options and install_plugins capabilities and logs in with it without going near the login form. The working variant documented by Wordfence and Nethemba generates the authentication cookie directly with wp_set_auth_cookie(). In neither case do multi-factor authentication, login attempt limits or login-hardening plugins get to run.

Did the first UpdraftPlus fix close the door?

TeamUpdraft pushed out an emergency release, 1.26.12 (free) and 2.26.12 (Premium), intended to wipe UpdraftCentral keys. Nethemba and BleepingComputer report that a bug stopped it working, and 1.26.13/2.26.13, released on the evening of 19 October, fixes the revocation.

Nethemba found that 1.26.13 only deletes keys created before 12:07 UTC on 18 October, although TeamUpdraft gives 22:00 BST (21:00 UTC) as the cutoff. Keys created between 12:07 and 21:00 UTC stay on the site and must be deleted by hand. Nethemba also advises deleting Migrator keys, stored in a separate option, although it has not seen them abused.

How many sites could be exposed?

BleepingComputer reports that about 10% of UpdraftPlus sites store UpdraftCentral or Migrator keys, which would mean roughly 400,000 websites at risk. Nethemba speaks of "fewer than 10%" and "up to around 400,000" out of more than four million installs, based on a vendor estimate prepared for the June flaw. Treat it as an order of magnitude, not a casualty list, because the number of sites that received the backdoor is unknown.

How does this change the usual WordPress risk model?

Many organisations look after their corporate website by keeping a plugin list, tracking the vulnerabilities in it and updating promptly, with a web application firewall (WAF) covering the gap. That approach handles code defects and should stay in place.

These two incidents fall outside it. The Rank Math update came from the genuine source. The UpdraftCentral commands were POST requests to the site root carrying a valid signature, traffic that a generic rule would not recognise as an attack.

Plugin-aware WAFs did step in after disclosure. Wordfence shipped an emergency rule, which reached free users a few hours after paying customers, that blocks inbound UpdraftCentral commands on versions before 1.26.12/2.26.12, legitimate ones included. Patchstack blocks the channel too, and for Rank Math it explained in its database that a rule was not possible.

The focus moves from which plugin carries a known flaw to which third parties can put code on the web server, and with what capabilities. The pattern is familiar from other supply-chain attacks on update channels, such as the tampered AOMEI Backupper updates or the BGP hijack that hit Virtualizor. Here the asset is a corporate website, often run by marketing or an outside agency and often missing from the register of critical suppliers.

What should change in how a corporate website is defended?

The inventory has to go beyond plugin names. Record which plugins pull updates from vendor servers outside WordPress.org, which remote-management consoles have keys installed on each site and which user accounts stand behind those keys. If an agency maintains the site, the contract should spell this out, and the agency should be vetted with the same third-party risk management criteria applied to suppliers with system access. A web application security audit ought to cover these trust relationships before it gets to version numbers.

Limiting what an intruder walks away with is the second line of defence. Rank Math tells customers to consider exposed all credentials reachable from the site, such as the database, API keys, SMTP and hosting access. A web server holding broadly scoped cloud keys turns a WordPress backdoor into an infrastructure incident, and the advice on scoping non-human identities and API keys applies directly.

Outbound traffic deserves the same discipline. Blocking rank1cdn[.]com only became possible once the advisory was out. A web server permitted to reach a short, fixed list of destinations (update repositories, the payment gateway, internal services) makes that command-and-control channel harder to use without waiting for an indicator.

Permissions are the last lever. On one of Nethemba's three sites the attack failed because the connection belonged to a user without the right to install plugins, and Nethemba also cites a case where a plugins folder that PHP could not write to stopped the install. The firm advises a read-only plugins directory where practical and, where remote management is needed, keys issued under a user without the install_plugins capability, applying the principle of least privilege in place of the administrator account.

What does recovering an affected site involve?

Rank Math, Wordfence and Nethemba advise treating the site as compromised, restoring from a backup taken before the incident and changing every credential. Rank Math and Wordfence include the WordPress keys and salts, and Wordfence and Nethemba ask for open sessions to be ended. TeamUpdraft suggests restoring from a backup made before 17 October if anything suspicious turns up. Without a tested backup that predates the intrusion, the fallback is a long, uncertain manual purge, as our guide to ransomware-resilient backups sets out.

For UpdraftCentral, Patchstack says to delete the keys on the site first and leave the malicious plugin unrepaired, because fixing the early samples' coding error brings it to life. Removing a site from the UpdraftCentral dashboard does not disconnect it. Patchstack advises against reconnecting until the vendor explains the cause, while TeamUpdraft and Wordfence say to reconnect using freshly issued keys once the site has been checked.

File integrity checks against the official distribution remain useful, as do regular reviews of users and their capabilities and sending web server access logs somewhere the attacker cannot reach. Nethemba points out that UpdraftCentral's internal log keeps only the last 50 events. If the investigation outgrows the in-house team, an incident response service can preserve evidence and establish the scope.

Which indicators of compromise should be checked?

For Rank Math PRO, the vendor's notice and Wordfence's analysis list these indicators of compromise.

• Outbound connections or DNS lookups for rank1cdn[.]com.
• The file wp-includes/class-wp-cache-util.php, which is not part of WordPress, plus .cache files containing PHP code and unexpected PHP files in uploads/ and mu-plugins/.
• The entries _uf6qdn2hmm, t8krdk990phb and _np5pvf754c in the wp_options table.
• Administrators whose username begins with wpsupport_ or whose email ends in @wp-mail[.]net, and jobs in the web server user's crontab tagged #ms6v46.

For UpdraftCentral, Patchstack, Nethemba and Wordfence flag these.

• Keys in the updraft_central_localkeys option, even if the dashboard was never used, and, according to Nethemba, in updraft_migrator_localkeys.
• Unknown plugins described as "Small maintenance toolkit: keeps option storage tidy", options ending in _sync_token and users with the display name "Site Tools" or addresses at @example.org and @example.com.
• Editor-role users who also hold manage_options, and administrators nobody recognises.
• POST requests to the site root with the user agent WordPress/6.4; class-udrpc.php or from 43.250.53.42 and 2a09:bac5:4e21:2e3c::49b:9. According to IT-Connect the IPv6 address is a shared Cloudflare WARP exit, so blocking or searching for it may produce false positives.
• GET requests to the site root carrying a 12-character hexadecimal parameter with a 32-character value, the backdoor trigger, like those Nethemba saw on 20 October from 178.83.37.220, 178.83.37.243 and 178.94.218.31.

With WP-CLI, these read-only checks cover some of the basics. wp core verify-checksums flags files that should not exist in wp-admin and wp-includes, but it does not inspect wp-content, and --include-root extends it to the root directory. wp plugin verify-checksums --all, which Rank Math suggests, can only verify WordPress.org plugins and skips premium ones. The --skip-plugins --skip-themes flags stop a malicious plugin from altering the output, although mu-plugins and drop-ins still load. The output of updraft_central_localkeys contains sensitive key material and should not be shared, and crontab -l -u needs root privileges.

wp core verify-checksums --include-root
wp plugin verify-checksums --all
wp option get updraft_central_localkeys --skip-plugins --skip-themes
wp option get updraft_migrator_localkeys --skip-plugins --skip-themes
wp option list --search="*_sync_token" --skip-plugins --skip-themes
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered --skip-plugins --skip-themes
wp user list --role=editor --field=ID --skip-plugins --skip-themes | xargs -I{} wp user list-caps {} --skip-plugins --skip-themes
crontab -l -u web-server-user | grep ms6v46

Is it known how the attackers got into the two vendors?

As of 21 October 2026, neither Rank Math nor TeamUpdraft has said how the attackers got into their systems. TeamUpdraft refers to an "underlying weakness" that has since been fixed and leaves it there, and it is not known how many sites received a backdoor in either case.

For an attacker, compromising one vendor that ships code or signs commands for thousands of sites beats breaking into those sites one by one, and it slips past the controls they built against code flaws. As long as that trade keeps paying, more cases in the commercial plugin market are likely. For any organisation running such plugins, the job is to know which outsiders can write to its web server, with which credentials and for how long.

Sources and attribution: this analysis draws on public disclosures by Rank Math, TeamUpdraft, Patchstack, Nethemba and Wordfence, on Verisign's RDAP record and on reporting by BleepingComputer, The Repository and IT-Connect, as available on 21 October 2026. Naming the vendors implies no design flaw in their products beyond what they themselves have disclosed. The vendors have not published how the intrusions happened, and details may change as investigations continue.

Note: the commands and indicators in this article are read-only and for guidance. Before deleting files, users or keys on a production site, take a full backup and, if there are signs of compromise, preserve the evidence for forensic analysis.