Rank Math, the maker of a popular WordPress SEO plugin, says copies of its paid Rank Math PRO plugin downloaded from rankmath.com, or delivered as an update, between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware. According to The Hacker News, the malware can recreate its hidden backdoor whenever someone visits the site, so any site that installed and activated one of those copies should be treated as compromised. Rank Math has removed the affected files and released a clean version, 3.0.124.
The detail that catches people out is that installing 3.0.124 replaces the plugin but does not remove files, administrator accounts, or scheduled tasks the malware may already have planted elsewhere on the server, per Wordfence. Rank Math’s changelog dates version 3.0.123 to October 7, so the version number alone does not tell you whether your copy is affected; the notice limits the incident to copies downloaded or updated inside the window. Wordfence assigned the incident CVE-2026-111862 and rates it 9.8 out of 10. The free Rank Math SEO plugin on WordPress.org is not named in the notice. Rank Math has not said how the malicious files entered its download and update system or how many customers received one.
How to check if you’re affected
Affected products are copies of the Rank Math PRO plugin (not the free Rank Math SEO plugin) that were downloaded from rankmath.com or auto-updated between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026. Rank Math’s notice sorts sites into three cases:
- Installed and activated 3.0.123 during the window: treat the site as compromised, even if it has since been updated to 3.0.124.
- Installed but never activated it: delete the plugin files, install 3.0.124 from your Rank Math account, and run a security scan.
- Downloaded but never installed or activated it: nothing in this incident alone indicates the site was compromised.
If you are unsure which case applies, Rank Math asks you to contact its support team.
For a compromised site, the vendor’s preferred recovery is to restore a backup of the site and database from before 20:02 UTC on October 15, scan, change every credential, and only then install 3.0.124 from your Rank Math account. With no clean backup, the order matters. Three steps come before anything else:
- Delete the entire
rank-math-proplugin folder using your host’s file manager or FTP. Deactivating alone is not enough, per the notice. - In the
wp_optionsdatabase table, delete any entry whoseoption_nameis_uf6qdn2hmm,t8krdk990phbor_np5pvf754c. - Block outgoing connections to
rank1cdn[.]comif your host or firewall allows it.
Only then look for other changes the attacker may have left, as reported by The Hacker News: PHP files in wp-content/mu-plugins/, in other plugins’ folders, in non-default theme folders and in uploads/; the non-core file wp-includes/class-wp-cache-util.php; administrator accounts starting wpsupport_ or with email addresses ending @wp-mail[.]net; .htaccess rules that let .cache files run as PHP; crontab entries tagged #ms6v46; and unfamiliar SSH authorized_keys entries. Wordfence cautions that finding none of these does not by itself prove a site is clean.
Change every credential the site could reach, even after a restore: WordPress passwords, the database login and the keys and salts in wp-config.php, payment and SMTP keys, hosting, FTP/SFTP and SSH access, and administrator two-factor authentication. Download 3.0.124 only by logging in at rankmath.com. Rank Math says it will never email login or download links.
Sources
- Rank Math: Rank Math PRO 3.0.123 security incident notice
- Wordfence: Rank Math SEO PRO 3.0.123 malware
- Patchstack: Rank Math SEO PRO 3.0.123 embedded malicious code
- The Hacker News: Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor
- BleepingComputer: WordPress SEO plugin Rank Math compromised to backdoor websites