Two companies that make popular WordPress plugins were broken into in October, and attackers used their systems to reach customers’ websites. If your site runs on WordPress, one of these plugins may be installed on it. This article explains what happened, how this kind of attack works, how to check your site, and what your options are for keeping plugins safe.

What is a WordPress plugin supply chain attack?

A plugin is an add-on that gives a WordPress site a feature it doesn’t have out of the box, such as search engine settings, contact forms or backups. Each plugin comes from a separate company or developer, and each one sends updates to your site.

A WordPress plugin supply chain attack is when attackers break into the company that makes a plugin, rather than into your site directly. They then use that company’s normal update or management tools to deliver harmful code. Your site accepts it because it appears to come from a source it already trusts. For example, you click “update” on a plugin you have used for years, and the new version contains a hidden backdoor, which is code that lets an outsider log in or run commands later.

What happened in October

Two separate incidents were made public within a few days of each other:

  • Rank Math PRO. Rank Math is a plugin that manages search engine settings such as page titles and descriptions. According to the security news site BleepingComputer, copies of the paid PRO version 3.0.123 downloaded between 8:02 p.m. UTC on October 15 and 7:12 a.m. UTC on October 16 contained malware. Rank Math said several hundred PRO customers were affected and released a clean version, 3.0.124. The free version was not affected.
  • UpdraftPlus. UpdraftPlus is a backup plugin used on millions of sites. Its maker, TeamUpdraft, said attackers accessed its customer database over the weekend of October 17 and 18. That database held connection keys for UpdraftCentral, a dashboard that lets one person manage many sites from one place. A connection key works like a password that lets the dashboard send commands to a site. Patchstack, a WordPress security company, reported that attackers used those keys to install backdoor plugins under 99 different names.

In both cases, updating the plugin afterward does not remove code that was already installed. Rank Math and the researchers studying the UpdraftPlus incident both make this point.

Why this matters even if you did nothing

In the UpdraftPlus case, a site could be exposed without anyone choosing to use UpdraftCentral. Patchstack reports that the option to create a connection key was ticked by default in some accounts, and that keys do not expire. A site connected months ago and then forgotten could still accept commands.

The fix also has a gap. Security firm Nethemba found that the first emergency update deleted no keys because of a bug, and that the corrected version, 1.26.13 (2.26.13 for Premium), still leaves keys created between 12:07 and 21:00 UTC on October 18. Those have to be deleted by hand.

How to check whether your site is affected

Three checks cover most of the risk:

  1. Look at your plugin list and versions. If Rank Math PRO 3.0.123 was installed and activated during the October 15 to 16 window, the vendor advises treating the site as compromised. If you use UpdraftPlus, confirm it is on 1.26.13 or later.
  2. Look for connection keys. In WordPress, go to Settings, then UpdraftPlus, then Advanced Tools, then UpdraftCentral. Delete any key you don’t actively use. Your backups keep working without it.
  3. Review every user account. Remove any administrator or editor you don’t recognize. Rank Math warned that attackers may have created accounts with names starting with “wpsupport_”, and Patchstack found backdoor accounts disguised as editors.

If you find anything suspicious, the safest path both companies describe is to restore from a backup made before the incident and then change every password and key the site uses.

Your options for keeping plugins updated

  1. Turn on automatic updates. Security fixes reach your site as soon as they are released. The trade-off is that a bad update, like the Rank Math file, also arrives automatically.
  2. Update by hand on a set schedule. Someone reviews each update and tests it on a staging site, which is a private copy of your site used for testing, before it goes live. This gives you more control, and security fixes arrive more slowly.
  3. Use a managed maintenance plan. Your host or an agency handles updates, monitoring and backups. It costs a monthly fee, and you rely on their process being careful.

Any of these can be the right choice for a given business. The size of your site, how often it changes and who has time to look after it usually decide it. Removing plugins you no longer use helps with every option, because each plugin is one more company you are trusting.

Where to start

For most sites this is an hour or two of checking, and the steps are the same for every site. A reasonable first pass looks like this:

  • List your plugins. Write down every plugin, its version and whether you still need it.
  • Check the two named plugins. Confirm Rank Math PRO is on 3.0.124 or later and UpdraftPlus is on 1.26.13 or later.
  • Delete unused connection keys and accounts. Remove UpdraftCentral keys you don’t use and any user you don’t recognize.
  • Confirm you have a recent, working backup. Make sure it is stored somewhere other than the website itself and that someone has tested a restore.
  • Decide who owns updates. Pick one of the three options above and write down who is responsible. If your site is due for a rebuild, that is a natural time to reduce the number of plugins it depends on.

If you’d like help with any of it, that’s work we do every day.