UpdraftPlus and Rank Math PRO Breaches: What WordPress Stores Must Check

Two widely used WordPress plugins were turned against the sites running them within four days of each other. Between October 17 and 19, 2026, attackers used connection keys stolen from TeamUpdraft, the company behind UpdraftPlus, to push backdoor plugins onto WordPress sites through UpdraftCentral. Days earlier, copies of the paid Rank Math PRO 3.0.123 downloaded from the vendor’s own site on October 15 and 16 contained malware. Neither attack needed a bug in your site. Both came through software you trusted. If your store runs on WordPress or WooCommerce and uses either plugin, check it today.

This article covers what happened, who is affected and the exact checks to run. All facts were checked against the vendors’ notices and Patchstack’s analysis on October 22, 2026.

What happened with UpdraftPlus and UpdraftCentral

UpdraftPlus is a backup plugin. It includes a client for UpdraftCentral, a dashboard that lets you manage many WordPress sites remotely. Connecting a site creates a key that lives on the site.

TeamUpdraft says unauthorised access was identified over the weekend of October 17 and 18, and it believes its customer database was accessed. According to its incident post, that database held names, email addresses, billing addresses, order history, hashed passwords, two-factor settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft says card details are not stored, because payments run through Stripe and PayPal, and that the UpdraftPlus plugin downloads were not affected.

Patchstack, which analysed the attacks, says the stolen keys were used to send validly signed commands that installed a backdoor plugin through WordPress’s normal installer. It first saw a backdoor installed on October 18 and observed the campaign over about 18 hours. Patchstack is clear that “this is not a vulnerability in UpdraftPlus.” The commands passed the site’s checks because they were signed with real keys.

The backdoor creates a hidden account that can install plugins and change settings, and logs the attacker in with a persistent cookie, which skips two-factor login. Patchstack notes the account stays after the plugin is removed.

TeamUpdraft released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) just after 10 p.m. BST on October 19. These versions revoke UpdraftCentral connection keys and disconnect sites. The company also signed out all accounts, issued new UpdraftVault credentials and replaced UpdraftClone client keys. Its post was last updated on October 21.

What happened with Rank Math PRO

Rank Math’s security notice says copies of Rank Math PRO 3.0.123 downloaded between 20:02 UTC on October 15 and 07:12 UTC on October 16 “contained malware that could compromise your website if the plugin was activated.” The vendor describes a hidden backdoor that can recreate itself and advises assuming site credentials may be exposed. The fix is version 3.0.124.

The free Rank Math SEO plugin on WordPress.org is not affected, according to the notice. Separately, free accounts registered between October 13 and 16 were removed during a system refresh and need to be recreated.

Timeline built from the Rank Math security notice, TeamUpdraft’s incident post and Patchstack’s analysis, checked October 22, 2026. Times in UTC; 10 p.m. BST on October 19 is 21:00 UTC.

Are you affected? A quick triage

Use this table to find your situation. It is built from the steps in each vendor’s notice and Patchstack’s guidance.

Your situation Risk What to do now

UpdraftPlus installed, site was ever connected to UpdraftCentral (cloud) High Update to 1.26.13 or 2.26.13, delete every UpdraftCentral key, check for unknown admins and plugins

UpdraftPlus installed, never used UpdraftCentral Check Patchstack says to check for keys anyway, because a key can exist without you using the dashboard. Update the plugin.

UpdraftPlus free, no teamupdraft.com account, no keys Low TeamUpdraft says no action is required; keep the plugin updated

You have a teamupdraft.com account Account data exposed Change that password and any reused password, reset two-factor, reconnect UpdraftVault with new credentials

Self-hosted UpdraftCentral Not affected per vendor Update UpdraftPlus as normal

Rank Math PRO 3.0.123 downloaded and activated in the window Treat as compromised Restore from a backup made before October 15, change all credentials, install 3.0.124

Rank Math PRO 3.0.123 installed but never activated Medium Delete the plugin files, install 3.0.124, run a security scan

Free Rank Math SEO only Not affected per vendor No action for this incident

Triage by E-commerce Partners from the TeamUpdraft incident post, the Rank Math security notice and Patchstack’s analysis. Checked October 22, 2026.

How to check an UpdraftPlus site

1. Log in to WordPress directly, by typing your site address, not through UpdraftCentral.
2. Update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or later. TeamUpdraft’s customer steps mention 1.26.12 and 2.26.12 as minimums, but its update notes name 1.26.13 and 2.26.13 as the versions that revoke keys, so use those.
3. Delete the keys. Patchstack gives the path: Settings > UpdraftPlus Backups > Advanced Tools > UpdraftCentral > Manage existing keys, then delete each key. Removing the site from the dashboard is not enough, because “the key that matters lives on the site.” Backups keep working without it.
4. Look for unknown accounts. Patchstack says the backdoor account appears as an Editor with extra capabilities, with usernames of two words plus two digits (it lists data-ops43 and media-staff96 as confirmed examples) and an @example.org email.
5. Look for unfamiliar plugins, including Must-Use plugins. Patchstack counted 99 backdoor plugin names. “Site Health Cache” recurs, and the most reliable sign is the description “Small maintenance toolkit: keeps option storage tidy.”
6. Do not repair a broken plugin you do not recognize. Patchstack warns that some backdoor samples cause errors and that fixing the error switches the backdoor on.
7. If you find anything, delete the keys first, then remove the plugin and the account, change all administrator passwords, end all sessions, and consider restoring from a backup made before October 17.
8. Do not reconnect UpdraftCentral until you are satisfied the site is clean. If you need remote management, Patchstack suggests creating the new key under an account that cannot install plugins.

How to check a Rank Math PRO site

1. Check which version you run under Plugins. If it is 3.0.123, work out when you downloaded it.
2. If it was activated during the window, restore the site and database from a backup made before October 15, then install 3.0.124. Rank Math gives a manual removal procedure if you have no clean backup.
3. Change all passwords, keys and API credentials stored on the site. For a store, that includes payment gateway keys, shipping and email service API keys, and database passwords.
4. Run a security scan after cleanup.

Why this matters for online stores

A WooCommerce store keeps customer data, order history and payment gateway keys in the same WordPress install. A hidden account that can install plugins can add a card skimmer to checkout, change payout settings or read API keys. Rank Math’s own notice tells affected users to assume credentials may be exposed.

Both incidents also break the usual advice. “Keep plugins updated” would not have helped on the day: the Rank Math malware came in an official update, and Patchstack said on October 19 that no UpdraftPlus update stopped the UpdraftCentral attack until the key-revoking release that evening. Three habits do help:

• Know which plugins hold remote access. Backup, management and migration plugins often hold keys that can install code. List them and remove keys you do not use.
• Keep dated backups off the server so you can restore to a known-clean point.
• Review admin and editor accounts monthly. New accounts with unusual names are often the first visible sign.

This comes in the same week as the critical PHP flaws covered in our PHP2Shell guide for online stores. If you manage your own WordPress hosting, patch both. Our e-commerce security checklist for small stores covers the wider routine, and our earlier piece on why a patched WordPress site can still be compromised explains why updating does not remove an existing infection.

What is still unknown

• How many sites received backdoors. Neither vendor has published a count.
• How the UpdraftCentral keys were taken. Patchstack says the evidence points to keys leaking from the UpdraftCentral Cloud environment; TeamUpdraft says the attacker “used a compromised key” and that the full extent is unknown.
• How many Rank Math PRO downloads were infected. The vendor has not given a number.

We will update this article if the vendors publish new findings.

Sources

• TeamUpdraft, “Security incident, October 2026” (posted October 19, updated October 20 and 21, 2026). teamupdraft.com
• Patchstack, “Stolen UpdraftCentral Keys Are Backdooring WordPress Sites” (October 19, 2026). patchstack.com
• Rank Math, “PRO 3.0.123 security incident” (October 16, updated October 19, 2026). rankmath.com
• Nethemba, UpdraftCentral backdoor analysis (first public analysis, credited by Patchstack). nethemba.com

Last reviewed: October 22, 2026. Versions, dates and steps match the TeamUpdraft and Rank Math notices and Patchstack’s analysis as checked on that date. This is a developing story.

How this article was made: researched and drafted with AI assistance, with every factual claim checked against the sources above. The triage table and timeline are our own summaries of the vendors’ and Patchstack’s guidance; no site was tested.

Related guides

• E-commerce Security in 2026: 7 Threats That Target Small Stores
• PHP2Shell: What Online Stores Must Do About the Critical PHP Flaws
• A Fake Stripe Form Is Skimming WooCommerce Carts