by WPadawan WordPress

Two WordPress Plugin Compromises in One Week: Rank Math PRO and UpdraftCentral

WordPress site owners had a rough few days. Two separate incidents, both involving trusted plugin vendors, surfaced within about 72 hours of each other. Neither one is a conventional bug in WordPress core. In both cases attackers abused the trust that sites place in their plugin suppliers.

Rank Math PRO: malware in the vendor’s own download

The first incident involves the paid Rank Math PRO SEO plugin. SecurityWeek reports that some packages of version 3.0.123 contained malware that could let attackers take over a website once the plugin was activated. The exposure window ran from 20:02 UTC on October 15 to 07:12 UTC on October 16, about 11 hours.

Rank Math says it pulled the affected files and published a clean release, PRO 3.0.124. Sites that installed and activated the bad package in that window should be treated as compromised. The vendor advises restoring from a clean backup made before the incident.

The malware is built to persist. According to a summary of Rank Math’s advisory, it can recreate hidden backdoors on page visits and expose WordPress credentials, database credentials and API keys. Indicators include unauthorized administrator accounts, hidden PHP backdoors, PHP-executable .cache files and a system cron marker. Simply updating or deactivating the plugin is not enough on an infected site, because the malware leaves database entries and files outside the plugin folder.

  • Only PRO is affected. The free Rank Math SEO plugin from WordPress.org is not.
  • The version number alone does not prove compromise. What matters is when your copy was downloaded or updated, and auto-updates count.
  • The issue has been assigned CVE-2026-111862 and a 9.8 critical severity score.
  • Rank Math describes the impact as limited to a limited number of users. No public count of infected sites has been given.

UpdraftCentral: stolen keys, not a code flaw

The second incident involves TeamUpdraft, the company behind the UpdraftPlus backup plugin. Patchstack’s analysis says an attacker holding valid UpdraftCentral dashboard keys installed backdoor plugins on connected sites. The campaign ran for roughly 18 hours across October 18 and 19.

Patchstack stresses that this is not a vulnerability in UpdraftPlus. The remote commands are correctly signed with genuine private keys, so every check in the plugin passes. As of October 19, Patchstack said, no plugin update stops the attack, and its advice is to delete your UpdraftCentral keys.

According to The Repository, the keys were stolen from TeamUpdraft itself. The company has also disconnected every UpdraftVault site and replaced all UpdraftClone client keys. It has reported the incident to the UK’s Information Commissioner’s Office. TeamUpdraft says it deployed a fix for the underlying weakness but has not explained how the attacker got in.

The same report says Patchstack’s telemetry showed backdoor installs across a broad set of sites. It counted 99 distinct backdoor plugin names. SecurityOnline reports that the backdoor creates a hidden account with editor rights and plugin-install power. It then logs the attacker in through a cookie, which bypasses the login form and two-factor authentication. Payment data was reportedly not exposed.

What site owners should do now

  • Rank Math PRO users: check when 3.0.123 was installed. If it falls in the window, restore a pre-October 15 backup, rotate every credential the web server could reach, and update to 3.0.124.
  • UpdraftPlus users: if the site has an UpdraftCentral key, delete it. Then look for unfamiliar plugins and hidden users. Updating the plugin alone does not protect you.
  • Everyone: audit administrator accounts, review recently installed plugins, and keep offline backups from before the incident dates.

The bigger lesson

Both incidents show that a fully patched site is not automatically a safe one. A signed update from a vendor’s own channel, or a legitimate remote-management key, passes every technical check. When the vendor’s infrastructure is the weak point, sites cannot rely on patching alone.

Treat remote-management keys like passwords. Remove ones you are not using. Consider delaying automatic updates on critical production sites by a short window, so that a compromised release can be caught and pulled before it reaches you. Both stories are still developing, so follow the vendors’ advisories for updates.

Source