How to Audit Your WordPress Site After October 2026's Plugin Compromises

Two popular WordPress plugin vendors got hit within days of each other this month, and in both cases the attack came in through a channel site owners trust. A Rank Math PRO update carried a backdoor for about 11 hours on October 15 and 16. Then TeamUpdraft, the company behind UpdraftPlus, said someone got into its customer database over the weekend of October 17 and 18, and the keys stolen from it were used to push backdoor plugins onto connected sites.

Nobody needed a weak password or an outdated plugin to get in. If you run either plugin, updating is step one, but it doesn't tell you whether someone was already inside. This post covers what happened, how to tell if a site is in scope, and the audit I'd run. All times are Central (CDT).

There's a third item this week, and it's a different kind of problem. Amelia, a booking plugin on more than 90,000 sites, patched a critical SQL injection that anyone can trigger without logging in. Nobody has reported it being exploited yet, but if you're already auditing, add it to the list.

It's been a heavy month already. If you haven't patched PHP yet, start with the PHP2Shell post and my October 2026 security patches roundup. A backdoored plugin and an unpatched PHP runtime are two different problems, and you probably have to deal with both.

Rather not run this audit yourself? I do these for small business sites. Get a free quote, or keep reading for the checklist.

Answer these four questions for each site:

1. Does it run UpdraftPlus, free or Premium, and has it ever been connected to UpdraftCentral cloud? If so, assume it was exposed until you've checked. Self-hosted UpdraftCentral isn't affected, according to TeamUpdraft.
2. Did it get Rank Math PRO 3.0.123 between 3:02 PM on October 15 and 2:12 AM on October 16? If that version was activated, treat the site as compromised. The free Rank Math SEO plugin from WordPress.org isn't affected.
3. Does it run the Amelia booking plugin, version 2.4.11 or earlier? Update it today. This one is a bug in the plugin, not a breach, and there are no reported attacks yet.
4. Do you manage it for someone else? Agency and freelancer accounts are where both of these hit hardest, because one vendor account touches dozens of sites.

One catch on question 1. Nethemba, a security firm whose own sites were hit, found that logging in to your teamupdraft.com account inside UpdraftPlus ticks "Add this website to UpdraftCentral" by default. A site can have a key even if you've never opened UpdraftCentral. TeamUpdraft is also telling Premium users to check their sites even if they never used it. Check every site that runs UpdraftPlus.

TeamUpdraft says an attacker accessed teamupdraft.com over the weekend of October 17 and 18. It believes the customer database was accessed, including names, email addresses, billing addresses, order history, hashed passwords, two-factor settings, and the connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. It doesn't store card details, and it says the UpdraftPlus plugin and its downloads weren't affected.

The UpdraftCentral keys are the dangerous part. A connected site runs any properly signed UpdraftCentral command, including "install this plugin." Nethemba's analysis shows the attacker doing exactly that starting the night of October 18. It sent signed plugin.upload_plugin commands that installed backdoor plugins with harmless-sounding names like "Load Stack 35C," "Boost Kit" and "Site Health Cache." Some variants create an account. TeamUpdraft says it's seeing a pattern of unexpected Editor accounts, and Nethemba found Editors with admin-level capabilities added. Other variants just log the attacker in as an existing administrator and leave nothing in the user list. At least one hides itself from the plugin screen.

Update to UpdraftPlus 1.26.13 (free) or 2.26.13 (Premium) or later. TeamUpdraft released them on October 19, a little after 4 PM, and says they revoke the old UpdraftCentral keys. It also says WordPress.org pushed the update to sites automatically.

Two details matter here:

• Skip 1.26.12 and 2.26.12. TeamUpdraft's step-by-step instructions still mention them. Nethemba reviewed the code and says a bug in that release means it doesn't delete any keys. Go straight to 1.26.13 or 2.26.13.
• Delete the key by hand anyway. Nethemba found that 1.26.13 only removes keys created before 7:07 AM on October 18, while TeamUpdraft's earlier statement put the cutoff at 4:00 PM that day. Keys created in between stay on the site. Nethemba also saw the attacker still sending commands on the morning of October 21. The update isn't proof you're clean.

To delete keys, go to Settings > UpdraftPlus Backups > Advanced Tools > UpdraftCentral, open the existing keys, and delete each one. From the command line:

wp option get updraft_central_localkeys
wp option delete updraft_central_localkeys

Then remove the site from your UpdraftCentral cloud dashboard too, and change your teamupdraft.com password. Once a site checks out, you can reconnect it.

Rank Math says Rank Math PRO 3.0.123 downloads between October 15 at 3:02 PM and October 16 at 2:12 AM contained malware that could compromise the site if the plugin was activated. Version 3.0.124 is the clean replacement. The free plugin isn't affected.

Rank Math's guidance depends on what you did with the file:

• Installed and activated 3.0.123: treat the site as compromised. Restore files and database from a backup made before 3:02 PM on October 15, then scan, change every credential, and install 3.0.124.
• Installed but never activated: delete the plugin files, install 3.0.124, and run a security scan.
• Downloaded but never installed: Rank Math says that alone doesn't indicate a compromise.

If you have to clean up by hand, order matters. Rank Math says the malware can rebuild its backdoor whenever someone visits the site. Delete the whole rank-math-pro folder first (deactivating isn't enough). Then remove the malicious wp_options rows Rank Math lists (_uf6qdn2hmm, t8krdk990phb and _np5pvf754c) and block outbound connections to rank1cdn.com if you can. Only then go hunting for the rest.

Rank Math's list of what to look for:

• Admin accounts starting with wpsupport_, or emails ending in @wp-mail[.]net
• A fake core file, wp-includes/class-wp-cache-util.php
• .htaccess rules that let .cache files run as PHP
• Crontab entries tagged #ms6v46
• PHP files in mu-plugins, in other plugins' folders, and in non-default themes' inc/, includes/ and lib/ folders

This one is a different kind of problem. Nobody's vendor account was breached and no update was poisoned. Amelia, a booking plugin with more than 90,000 active installs, had a SQL injection bug that anyone can trigger without logging in. Patchstack published it on October 20 as CVE-2026-112327, rated 9.3 (critical), and it affects every version of the free plugin through 2.4.11.

The CVE record rates it as high impact on confidentiality, so the main worry is someone reading data out of your database. On a booking site that's customer names, emails, phone numbers and appointment history. A SQL injection in a plugin usually runs with the same database access as the rest of WordPress, so the users table is within reach too.

Is it being exploited? Not that anyone has reported as of October 22. Patchstack says it expects the bug to be used in mass-exploit campaigns. That's a prediction, not a report of attacks. It isn't on CISA's Known Exploited Vulnerabilities list, and I haven't seen public exploit code. But an unauthenticated SQL injection in a popular plugin is exactly the kind of bug that gets automated once someone works out the details, so don't wait for the first report.

Which version to install. Patchstack and the CVE record list 2.4.12, released October 19, as the fix. Amelia then shipped 2.4.13 on October 22. Its changelog just says "important security fixes," but the code changes are to how the plugin builds its database queries. I'd go straight to 2.4.13 or later.

wp plugin list --skip-plugins --skip-themes | grep -i amelia
wp plugin update ameliabooking --skip-plugins --skip-themes

If you run Amelia Pro. The free plugin uses 2.x version numbers, and the paid versions use 8.x and 9.x. The advisory only lists the free plugin's versions, and Amelia's own changelog shows Pro 9.9.1 from October 2 as the newest release. I can't tell you whether Pro shares the bug. Check Amelia's changelog for a release after 9.9.1 and ask their support rather than assuming either way.

Check the logs. Amelia's front end talks to the server through admin-ajax.php?action=wpamelia_api. Patchstack hasn't said which parameter is vulnerable, so there's no exact signature to look for. Requests to that endpoint carrying SQL keywords since mid-October are worth a closer look:

grep 'wpamelia_api' /var/log/apache2/*access* | grep -iE 'union|select|sleep|benchmark'

That only catches parameters in the URL. POST bodies don't show up in access logs, so a clean result isn't proof of anything. If you do find hits from before you updated, treat the customer data as exposed. Run the checklist below, rotate passwords and salts, and talk to whoever handles your breach-notification obligations.

The vendor-specific steps above cover each incident. This checklist works for both, and for the next one. I run it with WP-CLI from the WordPress root. Add --skip-plugins --skip-themes to the commands so a broken or malicious plugin can't crash WP-CLI or interfere with what it reports.

1. Take a snapshot first. Before changing anything, copy the files and export the database. If this turns into an investigation, you'll want the evidence, and some backdoors remove their own traces when you uninstall them from the admin screen.

2. Check plugin versions.

wp plugin list --skip-plugins --skip-themes

UpdraftPlus should be 1.26.13 or 2.26.13 or later. Rank Math PRO should be 3.0.124 or later. The free Amelia plugin should be 2.4.13 or later. Write down anything you don't recognize.

3. Compare the plugin list to what's on disk. A plugin that hides itself from the admin screen still has to exist as files. List the folders directly and compare:

ls -la wp-content/plugins/ wp-content/mu-plugins/
wp plugin list --status=must-use --skip-plugins --skip-themes

Anything you didn't install is suspect, especially in mu-plugins, which loads automatically and never shows an activate button. The TRUST#GRAFT backdoor drops a copy of itself there as wmedia-recovery.php, so a clean Plugins screen doesn't mean a clean mu-plugins folder. Check wp-content/upgrade/ too. Nethemba notes a pushed plugin can be left unpacked there even when the install failed.

4. Audit users, and not just administrators.

wp user list --role=administrator --skip-plugins --skip-themes
wp user list --role=editor --skip-plugins --skip-themes
wp user list --fields=ID,user_login,user_email,user_registered,roles --orderby=registered --order=DESC --skip-plugins --skip-themes

Look for accounts created since October 15, unfamiliar Editors, and the patterns both vendors published. Then check what each odd account can actually do. An Editor with manage_options or install_plugins is effectively an admin:

wp user list-caps <user-id> --skip-plugins --skip-themes

5. Verify file integrity.

wp core verify-checksums --skip-plugins --skip-themes
wp plugin verify-checksums --all --skip-plugins --skip-themes

The core check catches added or modified core files, like Rank Math's fake class-wp-cache-util.php. The plugin check only covers plugins hosted on WordPress.org, so premium plugins like Rank Math PRO and UpdraftPlus Premium need comparing against a fresh copy from the vendor's site.

6. Look for PHP where it doesn't belong.

find wp-content/uploads -name '*.php'
find . -name '*.php' -newermt '2026-10-15' -not -path './wp-content/cache/*'

The uploads folder should almost never hold PHP. The second command lists PHP files changed since October 15. Expect legitimate updates in there, but every file should have an explanation.

7. Check scheduled tasks.

wp cron event list --skip-plugins --skip-themes
crontab -l

Look for WordPress cron hooks you can't tie to a known plugin, and for system cron jobs you didn't write.

8. Read the logs. The UpdraftCentral log (Advanced Tools > UpdraftCentral > recent log events) should show nothing like plugin.upload_plugin or probe.central.updraftplus.com. It only keeps the last 50 events, so search the web server access log as well. Nethemba suggests looking for UpdraftCentral requests with a stripped-down User-Agent:

grep 'class-udrpc.php"' /var/log/apache2/*access*

For a TRUST#GRAFT-style install, look for plugin uploads and activations you didn't do, and check the timestamps against when you were actually working on the site:

grep -E 'update\.php\?action=upload-plugin|plugin-install\.php\?tab=upload|plugins\.php\?action=activate' /var/log/apache2/*access*

On nginx, swap in /var/log/nginx/. On shared hosting or cPanel, the raw access logs are usually under Metrics.

9. Find your last clean backup, and don't overwrite it. For Rank Math, that means a backup from before 3:02 PM on October 15. For UpdraftCentral, TeamUpdraft says before October 17. Check that your backup retention will keep it. A nightly job that only keeps seven days can roll past it while you're still investigating.

10. Rotate credentials if anything turned up. That means WordPress admin passwords, the database password in wp-config.php, hosting, SFTP and SSH logins, and any API keys stored in plugin settings, like SMTP, payment gateways and storage. Regenerate the WordPress salts, which also logs out every session:

wp config shuffle-salts

I wrote up the order I use in how to rotate API keys after a breach. If the site was reached through UpdraftCentral, TeamUpdraft also recommends re-authorizing your remote backup storage and changing its access keys.

Don't just delete the plugin and move on. If a backdoor was active, the attacker could have added other plugins, a web shell, or database changes you haven't found yet. Restoring from a clean backup is safer than trying to find everything by hand, and it's what both vendors recommend. Restore, update everything to the fixed versions, delete the UpdraftCentral keys, rotate credentials, and watch the site for a few days for files that come back.

One more from Nethemba: if you find one of the broken backdoor variants that crash the site, don't "fix" it. The bug is the only thing keeping it from working.

The UpdraftCentral and Rank Math incidents were supply chain attacks. Nobody broke WordPress. They abused trust in a vendor's update file and a vendor's remote management keys, the same pattern I covered in the Composer supply chain attack checklist. Remote management is convenient, but every connected dashboard is a key to every site it manages. If you don't use it, disconnect it. If you do, Nethemba notes that a key created by a user who can't install plugins couldn't install a backdoor on one of its sites.

Amelia is the old-fashioned kind of problem, a bug in the plugin's own code. Booking, form and checkout plugins take input from anyone on the internet, so those are the ones I'd keep on automatic updates even if I hold back everything else.

Is the free UpdraftPlus plugin affected by the UpdraftCentral breach?

It can be. The UpdraftCentral client ships in both the free and Premium versions. A site is only at risk if it has an UpdraftCentral cloud connection key, which can be created when you log in to a teamupdraft.com account inside the plugin. Update to 1.26.13 or later and delete any UpdraftCentral keys.

Which UpdraftPlus version fixes the UpdraftCentral key compromise?

UpdraftPlus 1.26.13 (free) or 2.26.13 (Premium) or later. Nethemba found that 1.26.12 and 2.26.12 don't actually delete the old keys, and that 1.26.13 misses keys created later on October 18, so delete keys by hand too.

Is the free Rank Math SEO plugin affected?

No. Only Rank Math PRO 3.0.123 downloaded between 3:02 PM CDT on October 15 and 2:12 AM CDT on October 16, 2026 was affected. Rank Math PRO 3.0.124 is clean.

I updated Rank Math PRO to 3.0.124. Am I safe?

Not necessarily. If 3.0.123 was ever activated, Rank Math says to treat the site as compromised, because the malware can leave files, accounts and cron jobs behind. Restore from a backup made before 3:02 PM CDT on October 15, 2026, or follow its manual cleanup steps in order.

Is the Amelia booking plugin vulnerability CVE-2026-112327 being exploited?

No attacks had been publicly reported as of October 22, 2026. Patchstack expects it to be used in mass-exploit campaigns, and it needs no login, so update now. Amelia versions through 2.4.11 are affected.

Which Amelia version fixes CVE-2026-112327?

Patchstack lists 2.4.12 as the fix. Amelia released 2.4.13 on October 22, 2026 with more security fixes, so update to 2.4.13 or later. If you run Amelia Pro, check Amelia's changelog and support, because the advisory only lists the free plugin's versions.

How do I check a WordPress site for backdoors with WP-CLI?

Run wp core verify-checksums, wp plugin verify-checksums --all, wp user list --role=administrator and wp cron event list with --skip-plugins --skip-themes. Then list wp-content/plugins and wp-content/mu-plugins directly and look for PHP files in wp-content/uploads.

What is the TRUST#GRAFT WordPress attack?

It's a campaign Securonix documented in October 2026. A malicious script uses a WordPress admin's already logged-in browser to upload and activate a fake "Web Media Optimizer" plugin. The plugin is a backdoor, and it copies itself to wp-content/mu-plugins/wmedia-recovery.php so it keeps running after the visible plugin is deleted.

Does two-factor authentication stop TRUST#GRAFT?

Not really. The attack doesn't log in. It reuses a browser session that already got past the login and two-factor prompt. Logging out of wp-admin when you're done, and using a separate browser profile for site admin, does more to help.

• TeamUpdraft, "TeamUpdraft security incident: What customers need to know"
• Nethemba, "Critical security problem in UpdraftCentral: an attacker holding the service's keys planted a backdoor on our websites"
• Rank Math, "Rank Math PRO 3.0.123 Security Incident: How to Secure Your Website"
• Patchstack, "WordPress Amelia Plugin <= 2.4.11 is vulnerable to a high priority SQL Injection"
• CVE.org, "CVE-2026-112327"
• WordPress.org, "Booking for Appointments and Events Calendar – Amelia" changelog
• Amelia, "Changelog" (Amelia Pro releases)
• Securonix, "TRUST#GRAFT: JavaScript-Compromised Sites Target WordPress Admin Browsers to Deploy a Persistent PHP Backdoor"
• GBHackers, "New TRUST#GRAFT Attack Tricks WordPress Admin Browsers Into Installing Malicious Plugins"