In brief
Your website ran normally all week, and yet a foreign plugin could have been installed on it overnight. That is exactly what has happened to WordPress sites in recent days. Two incidents are running in parallel, and they work differently. That is why you check them differently, too.
---
## What exactly happened
- For Rank Math SEO PRO, copies of version 3.0.123 were affected, downloaded or updated between 15 October 2026, 20:02 UTC, and 16 October 2026, 07:12 UTC. The clean replacement is 3.0.124.
- With Updraft, the problem was not the plugin code but the vendor: over the weekend of 17 to 18 October 2026 there was unauthorized access to teamupdraft.com, and UpdraftCentral connection keys were leaked in the process.
- A plain update is not enough. The malware may have left behind additional files, administrator accounts and scheduled tasks.
| Incident | Affected | Period | What you need to do |
|---|---|---|---|
| Rank Math SEO PRO | Some copies of version 3.0.123 contained malware | Download or update between 15.10.2026, 20:02 UTC, and 16.10.2026, 07:12 UTC | Check the version; if it matches, treat the site as compromised |
| TeamUpdraft | Customer database and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone | Access over the weekend of 17 to 18.10.2026 | Check whether UpdraftCentral was connected, renew keys |
The trap with the Pro version: According to reader reports, UpdraftCentral is preselected when you connect your Pro account. Many people never deliberately ticked that box and don’t use central management at all. Anyone who has connected the Pro version to their account can still be affected.
Anyone who only uses the free version locally has so far reported no anomalies. That is a reader report and not an all-clear from the vendor. But the possibility that the email address in the account has leaked applies here as well.
---
## Step by step: checking your installation
The commands assume shell access and WP-CLI installed. Run them in the WordPress directory.
- Back up the site before you change anything. Take an image of files and database. You will need the current state later as evidence.
wp db export vorfall-$(date +%F).sql tar czf vorfall-dateien-$(date +%F).tar.gz . - List plugins and versions. Look for Rank Math SEO PRO 3.0.123 and for plugins you don’t recognize.
wp plugin list --fields=name,status,version,update - Check administrator accounts. Any account you didn’t create yourself is an alarm signal.
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered - Look at scheduled tasks. The malware may have left cron jobs that reload it after you clean up.
wp cron event list - Search for recently changed files. Anything changed during the incident period that doesn’t come from you deserves a close look.
find wp-content -type f -name '*.php' -mtime -10 -ls - Check the plugin folder. An unknown folder under
wp-content/pluginsis suspicious, especially if it was created in the night leading up to 19 or 20 October.ls -lat wp-content/plugins | head -20
wp plugin verify-checksums --allDon’t just clear away the obvious plugin. Once someone has taken over the site, they can leave access in several places. When in doubt, a clean reinstall with the data restored is faster and safer than months of tracking down traces.
* **Remove the plugin:** Delete the affected folders, don’t just deactivate them. Then install Rank Math PRO fresh in version 3.0.124.
* **Clean up accounts:** Delete unknown administrators, change all remaining passwords and end active sessions.
* **Renew secrets:** Database password, the keys in wp-config.php and all API credentials that were stored on the server.
* **Reconnect Updraft:** All keys have been invalidated. Set a new password for your Updraft account, reconnect your sites and deselect UpdraftCentral only if you don’t need it.
* **Check backups:** A backup from after 15 October 2026 may already contain the backdoor. When in doubt, restore an older state.
If you are responsible for this on behalf of customers, a data leak may have to be reported. Clarify that with your data protection officer before you consider the incident closed.
---
## Why an update isn’t enough here
In both incidents the malicious code arrived via a route you trust: a plugin update or a management connection. Readers report that updates were installed even without auto-updates enabled. One commenter points to a wordpress.org mechanism that allows updates to be forced server-side during acute security situations. That is not confirmed for these incidents, but it shows how little your own setting helps you here.
That is why what happens after installation matters: a plugin that quietly grants itself privileges only gets noticed if you look. It went similarly with the [Virtualizor incident with a planted update](https://prepaid-host.com/de/blog/virtualizor-bgp-hijack-kompromittiert-was-jetzt-zu-tun-ist), which we have also written up.
### Early warning instead of chance
One reader only noticed the incident because their site was unreachable in the morning. With external monitoring you find out sooner: with [our monitoring](https://prepaid-host.com/de/monitoring/order) you keep an eye on sites and services, and an outage after a nightly plugin update won’t first catch your attention at breakfast.
If WordPress runs on your own server, you can separate sites more cleanly from one another. With [web hosting on the root server](https://prepaid-host.com/de/rootserver/webhosting), each installation gets its own area, so a compromised site doesn’t automatically take the others down with it. How to lock down access to the server itself is covered in our guide to [securing SSH with a key and fail2ban](https://prepaid-host.com/de/blog/ssh-zugang-richtig-absichern-schluessel-port-fail2ban).
---
## Checking that it worked
* **Plugin list:** Only known plugins, Rank Math PRO in version 3.0.124 or newer.
* **User list:** Only administrators you created yourself.
* **Cron list:** No events with unknown hooks.
* **File search:** The find command from step 5 returns only changes you can explain.
* **Logs:** After the cleanup, the access log shows no more requests to files that no longer exist.
Repeat the check a week later. If something new turns up, the cleanup was incomplete.
A matching version number alone says nothing. What matters is what was created on your server between the download and today.
Frequently asked questions
Am I affected if I use Rank Math PRO?
Only if an affected copy of version 3.0.123 was downloaded or installed via update in the period from 15 October 2026, 20:02 UTC, to 16 October 2026, 07:12 UTC. The version number alone proves nothing, but if that copy was active, you should treat the site as compromised. Version 3.0.124 is the clean replacement.
Do I have to delete the Updraft plugin?
According to the information so far, the plugin itself was not affected, but the vendor TeamUpdraft was. What matters is whether your Pro account was connected to UpdraftCentral. If so, check the installation for unknown plugins, set a new account password and reconnect the site.
Is it enough to update the plugin?
No. The malware may have left additional files, administrator accounts or scheduled tasks that an update does not remove. Check users, cron jobs and newly created files, and replace the credentials.
What data was leaked at TeamUpdraft?
The vendor assumes access to the customer database: names, email addresses, billing addresses, order history, hashed passwords, 2FA settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone.
Can I trust my backups after the incident?
Only with caution. A backup created after 15 October 2026 may already contain the backdoor. When in doubt, restore an older state and then repeat the checking steps.
