WordPress Plugin Attacks October 2026: Rank Math, UpdraftPlus

October 2026 has been one of the most serious months for WordPress security in recent memory. Attackers exploited a critical file-upload flaw in a page-builder toolkit, hijacked the update channel of a premium SEO plugin, and stole remote-management keys from a backup service. Then, on October 21, 2026, the PHP project released emergency patches for two critical remote code execution flaws in PHP itself.

These incidents are not known to be connected, and each reaches websites in a different way: an exploited plugin vulnerability, a supply-chain compromise, stolen access keys and a server-level language flaw. One rule applies to all of them: updating closes the entry point, it does not undo what an attacker already changed.

Quick reference: October 2026 incidents

Bricksforge: critical remote code execution

Bricksforge, an advanced toolkit for Bricks Builder, has a critical flaw tracked as CVE-2026-85097 with a CVSS score of 10.0. Versions up to 3.1.8.9 let unauthenticated attackers upload and execute PHP files, giving them full control of the site. Patchstack observed exploitation starting October 7.

What to do: update to 3.1.8.10 immediately, then search upload directories and theme folders for unexpected PHP files. If the vulnerable version was live after October 7, assume the site needs inspection, not just a patch.

Rank Math SEO PRO: a self-restoring backdoor

Rank Math PRO, the paid edition of the Rank Math SEO plugin, distributed malware for about 11 hours. Copies downloaded from rankmath.com or delivered as updates between October 15 at 20:02 UTC and October 16 at 07:12 UTC contained a backdoor. Wordfence assigned it CVE-2026-111862 with a 9.8 severity score, and Patchstack notes that firewall rules cannot mitigate it, because the attack happened inside Rank Math’s own systems. The free Rank Math SEO plugin on WordPress.org is not affected.

The version number does not tell you if you are affected. Version 3.0.123 was first released on October 7, so copies installed before the window are clean. What matters is when your copy was downloaded or updated:

• Installed and activated during the window: treat the site as compromised, even if it now runs 3.0.124.
• Installed but never activated: delete the plugin files, install 3.0.124 from your Rank Math account and run a security scan.
• Downloaded but never installed: this incident alone does not indicate compromise.

Why updating is not enough. The malware recreates its hidden backdoor whenever someone visits the site. Installing 3.0.124 replaces the plugin but leaves behind files, administrator accounts and scheduled tasks the malware placed elsewhere.

Recovery order. Rank Math recommends restoring a site and database backup from before October 15 at 20:02 UTC, then scanning, rotating all credentials and installing 3.0.124. Without a clean backup, begin with these three steps before anything else:

1. Delete the entire rank-math-pro folder through your file manager or FTP. Deactivating is not enough.
2. Delete the wp_options entries named _uf6qdn2hmm, t8krdk990phb and _np5pvf754c.
3. Block outgoing connections to rank1cdn[.]com.

Indicators of compromise:

• PHP files in wp-content/mu-plugins/, other plugins’ folders, the inc/, includes/ and lib/ folders of non-default themes, and uploads/
• A file at wp-includes/class-wp-cache-util.php, which is not part of WordPress core
• Code using base64_decode with XOR loops, the key xmmqhn, or proc_open
• Administrator usernames starting with wpsupport_ or emails ending in @wp-mail[.]net
• .htaccess rules running .cache files as PHP, crontab entries tagged #ms6v46, unknown scheduled events and new SSH authorized keys

Wordfence cautions that the absence of these indicators does not prove a site is clean. Rotate every credential the site could reach, and download 3.0.124 only by logging in at rankmath.com directly. Rank Math never sends download links by email.

UpdraftPlus and UpdraftCentral: stolen connection keys

UpdraftPlus is one of the most widely used backup plugins, with more than 3 million active installations. Attackers stole UpdraftCentral connection keys from TeamUpdraft. Because commands signed with those keys looked authentic, connected websites accepted them as legitimate, allowing attackers to install rogue plugins, create administrator accounts and plant persistent backdoors.

This was a key compromise, not a flaw in the plugin’s code. Updating to 1.26.13 (free) or 2.26.13 (Premium) revokes the compromised keys, but it does not remove anything already installed on a site.

What to do: update, follow TeamUpdraft’s instructions for replacing UpdraftCentral connections, review installed plugins and administrator accounts, and re-authorize remote storage such as Dropbox, Google Drive or Amazon S3 with freshly rotated access keys.

PHP2Shell: when the threat sits below WordPress

On October 21, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities that can allow unauthenticated remote code execution. Some coverage has labeled them “PHP2Shell.” The PHP security team gave advance notice a day earlier, rated both flaws CVSS v4.0 9.2, and urges every PHP user to update immediately.

This matters to every WordPress site, regardless of which plugins it runs. The PHP team says the risk is highest for Apache mod_php, where it has a demonstrated exploit in which an unauthenticated request triggers the attack before any application code runs. WordPress, its security plugins and any firewall rules written in PHP never get the chance to act.

Who is at risk. Every PHP installation that serves web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.

How to update:

• Ask your host to upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart PHP workers. Linux distributions and LTS vendors received the patches in advance, so updated packages should already be available.
• PHP 8.1 and older no longer receive official updates. The PHP security team published minimal source backports for 7.4, 8.0 and 8.1, and some LTS vendors offer backported fixes, but upgrading to a supported version is the real fix.
• PHP 8.2 reaches end of life on December 31, 2026, so sites on 8.2 should plan their next upgrade now.
• Servers relying on the volunteer-run rpms.remirepo.net repository did not get same-day updates; the PHP team recommends switching to distribution packages or building from source.
• Confirm your version under Tools > Site Health > Info > Server rather than assuming your host has patched.

If you cannot update immediately. The PHP team is explicit that these steps reduce exposure to specific attack paths but do not make a server safe.

For the out-of-memory flaw:

• Set memory_limit=-1 in a way applications cannot override, such as php_admin_value in the FPM pool or Apache configuration. An underlying allocation failure can still reach the vulnerable code.
• Lower post_max_size to 8M for sites without uploads or 32M where uploads are needed, keeping upload_max_filesize below it. Consider enforcing request size, field count and header limits at the web server or proxy level.
• Use a container or cgroup memory limit as a safety boundary. Do not use RLIMIT_AS or RLIMIT_DATA, which can trigger the vulnerable failure.

For the stale state flaw:

• Set session.upload_progress.enabled=0 in php.ini, the FPM pool or server configuration, then restart every worker. Setting it through ini_set() or a .user.ini file does not work.
• On PHP 8.5, set fatal_error_backtraces=0 and restart workers.
• Remove invalid or deprecated per-request settings that emit diagnostics before initialization. Hiding errors with display_errors or the @ operator does not help.

For most WordPress site owners on managed hosting, these settings are a conversation with the host, not something to change yourself. The practical action is to confirm the patched version is live.

How to audit your WordPress site now

If your site was active or updated between October 7 and October 22, 2026, work through this triage.

Security checks

1. Check your PHP version under Tools > Site Health > Info > Server. If it is not 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later, contact your host.
2. Scan for unauthorized files with a server-level scanner or a tool such as Wordfence.
3. Review users under Users > All Users and delete unknown administrator accounts.
4. Review plugins, including hidden ones, by comparing the admin list against the plugins directory on the server.
5. Rotate credentials: WordPress passwords, database credentials and salts in wp-config.php, hosting, FTP, SFTP and SSH access, SMTP, payment and API keys, and remote storage keys.
6. Restore from a clean backup if compromise is confirmed, making sure it predates the relevant exposure window.

SEO checks

Compromised WordPress sites are often used for SEO spam, so also look for:

• Conditional redirects that only trigger for Googlebot or mobile visitors
• Spam pages, doorway pages or unfamiliar URLs in your XML sitemap
• Injected links, hidden text or rewritten title tags and meta descriptions
• New 404 or 500 errors on previously healthy pages
• Changed robots.txt rules, unexpected noindex tags or altered canonical tags
• Security issues or manual actions in Google Search Console

The fastest way to see what changed is to compare a fresh crawl against one taken before October 7. New URLs, changed status codes, redirect chains and altered canonicals stand out immediately. Crawl with a Googlebot user agent too, since some malware hides spam from regular browsers. A crawler like SiteAuditLint detects these visible SEO symptoms, but it cannot see server-side code, database changes or malware that produces no output, so pair it with a malware scanner and server log review.

One outcome, four routes

The October incidents reach the same outcome by different routes: attacker-controlled PHP running on your server. Bricksforge did it through a file upload, Rank Math PRO through a poisoned update, UpdraftPlus through stolen keys, and the PHP flaws through the language runtime itself.

For WordPress site owners, plugin hygiene and server patching now need to be treated as one security process. Remove plugins you do not use, follow vendor advisories for the ones you keep, confirm your host patches PHP promptly, and keep a clean crawl baseline so you can see exactly what changed when something goes wrong.

For more on auditing WordPress sites, see our WordPress SEO hub .