WordPress Supply-Chain Double Hit: Rank Math PRO Backdoor and UpdraftCentral Key Exposure

Rank Math PRO 3.0.123 backdoor and UpdraftCentral key leak: what K-12 WordPress admins must inventory, rotate, scan, and restore.

Rank Math PRO 3.0.123 packages downloaded or updated between 20:02 UTC Oct 15 and 07:12 UTC Oct 16, 2026 contained malware that planted a self-restoring backdoor.
TeamUpdraft disclosed unauthorized access to teamupdraft.com on Oct 17–18, 2026; exposed UpdraftCentral connection keys were used to install malicious plugins on WordPress sites.
Any school or district WordPress site in those windows should be treated as potentially compromised: site takeover, credential theft, and persistent remote access are the main impacts.

What to do now

Inventory every WordPress site for Rank Math PRO 3.0.123 installed or updated between Oct 15 and Oct 16, 2026, and for UpdraftCentral connections; isolate affected sites from further plugin changes.
Replace Rank Math PRO files with a vendor-verified clean package and compare hashes; do not trust existing files or version numbers alone.
Revoke and rotate UpdraftCentral connection keys, WordPress admin passwords, database credentials, SFTP/SSH keys, API tokens, and authentication salts; invalidate active sessions.
Hunt for persistence: web shells in wp-content, uploads, mu-plugins, rogue admin users, scheduled tasks or cron jobs, modified .htaccess, and unexpected outbound connections; preserve logs before cleanup.
If compromise is confirmed, restore from a backup that predates Oct 15, 2026, then redeploy the clean plugin; enforce MFA, least privilege, staged updates, and file integrity monitoring.