Rank Math PRO · UpdraftCentralTwo WordPress plugin attacks: is your site affected?

npx wardlatch@latest --incident wordpress-plugins-2026-10

It looks for WordPress installs up to five folders down in /var/www, /srv/www, the Mac’s /Library/WebServer/Documents and the usual project folders, such as ~/Sites and ~/Development (or only in the folders you give with --paths), and reads the version headers of Rank Math PRO and UpdraftPlus, without running WordPress or any PHP. For a site anywhere else, such as ~/public_html on cPanel, give --paths the site’s folder (the one that holds wp-content) or a folder up to five levels above it. If it says no WordPress installs were found, it didn’t find your site. It flags Rank Math PRO 3.0.123, any PHP or JavaScript file (.php, .js or .inc) in that plugin’s folder that contains the attack’s indicator, and UpdraftPlus older than 1.26.13 (premium 2.26.13), each as EXPOSED with the fix; it searches up to 4,000 files, each up to 2 MB, at most 12 folders down, and says UNKNOWN for what those limits or a folder it can’t open leave out. It lists as REVIEW each plugin folder whose creation time is on or after the start of 2026-10-18 (UTC), for you to look at; where the file system keeps no creation time, it goes by the folder’s last status change. It changes nothing and sends nothing.

By hand, run from the folder that holds wp-content (usually the site’s main folder; wp-config.php may sit one folder above it). The versions of the two plugins:

LC_ALL=C grep -D skip -H -m 1 'Version:' wp-content/plugins/seo-by-rank-math-pro/rank-math-pro.php wp-content/plugins/updraftplus/updraftplus.php

The attack’s indicator in any file in Rank Math PRO’s folder, and the plugin folders created or changed since 2026-10-17, a day early to cover every time zone (a plugin you updated, or a folder whose owner or permissions changed, since then is listed too). LC_ALL=C keeps grep from skipping a line that isn’t valid UTF-8, and -D skip from waiting forever on a special file such as a named pipe. The find line goes by each folder’s status-change time (-newerct), which the system sets whenever a folder is created or changed and which a program can’t set to an earlier date; the modified time can be, by an attacker or by unpacking a plugin’s zip file with its old dates, so -newermt could miss a planted folder. Each name ends with a NUL byte (grep --null, find -print0), which tr turns into a line end, turning a newline inside a name into ?, so each name listed stays on one line. Both lines then pass what they print, error messages included, through cat -v, with tr and cat run as command tr and command cat so an alias or function with either name isn’t run: a control character in a file or folder name shows in cat -v notation, such as ^[ or M-BM-^[, and isn’t acted on, and a name with accents or other non-ASCII letters shows as M- sequences, é as M-CM-). “Permission denied” and “No such file” still show in full.

{ LC_ALL=C grep -D skip -rl --null rank1cdn wp-content/plugins/seo-by-rank-math-pro | LC_ALL=C command tr '\n\0' '?\n'; } 2>&1 | LC_ALL=C command cat -v
{ find wp-content/plugins -mindepth 1 -maxdepth 1 -newerct 2026-10-17 -print0 | LC_ALL=C command tr '\n\0' '?\n'; } 2>&1 | LC_ALL=C command cat -v

Rank Math PRO

Version 3.0.123, or any file listed by the indicator search: follow Rank Math’s steps in section C.

UpdraftPlus

Older than 1.26.13 (premium: older than 2.26.13): update it and delete its UpdraftCentral keys.

New folders

A plugin folder listed that nobody on your team installed may be one of the planted backdoors; Patchstack saw 99 different names.

Not read

An error line starts with grep: or find:; any other line is a file or folder name, with a newline in it shown as ?, or the rest of an error line whose file name holds a newline. An error line that ends “Permission denied” means that file or folder wasn’t read, so it wasn’t checked: run the line again with sudo in front of LC_ALL=C grep or find.

Not installed

An error line that starts with grep: and ends “No such file or directory” for one plugin’s file or folder means that plugin isn’t installed in wp-content/plugins.

Wrong folder

A find: error line saying “No such file” for wp-content/plugins itself, or grep: error lines saying it for both plugins, can mean you’re in the wrong folder, not that the site is safe: change to the folder that holds wp-content and run them again. If your site keeps its plugins elsewhere (Bedrock uses app/plugins), use that folder instead.

Rank Math also says you can see the installed Rank Math PRO version on the Plugins screen in WordPress admin.

• Rank Math PRO 3.0.124 is the clean release. Install it only after cleaning the site, and download it only by logging in at rankmath.com: Rank Math says it never sends login or download links by email. The free Rank Math SEO on WordPress.org is not affected, Rank Math says.
• UpdraftPlus 1.26.13 and premium 2.26.13, released on 2026-10-19, disconnect every UpdraftCentral connection made before 13:07 BST on 2026-10-18, so the old keys stop working. WordPress.org pushed the update to every site, TeamUpdraft says; check that yours has it.
• Neither removes a backdoor already on a site: that takes the steps below.

1. Rank Math PRO 3.0.123, activated: treat the site as compromised. Restore the files and the database from a backup made before 20:02 UTC on 2026-10-15, run a security scan, rotate every password and secret the site could reach, then install 3.0.124 from your Rank Math account. Without a clean backup, follow the manual clean-up in Rank Math’s notice, in its order, or get your host or a security professional to.
2. Rank Math PRO 3.0.123, installed but never activated: delete the plugin’s files, install 3.0.124 from your Rank Math account, and run a security scan.
3. UpdraftPlus with UpdraftCentral: update UpdraftPlus, delete the UpdraftCentral key in its settings, review the administrator accounts and the plugins (including must-use plugins), and change the administrators’ passwords. If anything looks wrong, restore from a backup made before 2026-10-17. Then reconnect.
4. A plugin folder you don’t recognise from 2026-10-18 or later: remove it, look for administrator accounts you don’t know, and rotate passwords. The backdoor can add an administrator that survives removing the plugin.
5. A teamupdraft.com account: TeamUpdraft asks every account holder to change that password, typing the address in yourself, to change it anywhere else you used it, and to reset two-step sign-in if you use it.

• Files, not the database. Wardlatch reads plugin files. It doesn’t look at WordPress’s users, database or scheduled tasks, where both attacks can leave things behind.
• A moved plugins folder. Wardlatch doesn’t read PHP. If a site’s configuration names a setting that moves the content or plugins folder, it says UNKNOWN for that site rather than guess.
• The server’s files only. Run it where the site’s files are. Sites at a host you can’t log in to need the host’s help.
• New folders are for review. A plugin folder Wardlatch lists may be one you installed: it can’t tell which.

Update, 2026-11-02 (0.1.12). Leftover and renamed copies of a listed plugin are checked now, such as a folder under wp-content/upgrade or backup/old. If an earlier version said SAFE for this check, run it again. The changelog has every change.

This page describes Wardlatch 0.1.9 and its incident file, wordpress-plugins-2026-10.json.

1. Rank Math, Rank Math PRO 3.0.123 security incident (the page shows no date): the window; PRO only; the clean 3.0.124; steps for an activated copy, an installed copy and a downloaded one; where to download.
2. TeamUpdraft, security incident, October 2026, 2026-10-19, updated to 2026-10-23: unauthorised access to its website, identified over the weekend of 17 and 2026-10-18; UpdraftPlus 1.26.13 and 2.26.13 revoke UpdraftCentral connections made before 13:07 BST on 2026-10-18; steps for site owners and account holders.
3. Patchstack, stolen UpdraftCentral keys used to backdoor WordPress sites, 2026-10-19 (the report Wardlatch’s incident file cites): backdoor installs seen from 2026-10-18; 99 plugin names.
4. Wardlatch 0.1.9, wordpress-plugins-2026-10.json and README: the versions, the indicator and the date it checks.

Credits · Patchstack credits Nethemba, who found the UpdraftCentral campaign on their own servers, published its analysis and reported it to TeamUpdraft. Rank Math’s and TeamUpdraft’s notices don’t name who reported the attacks. All sources read 2026-10-25.