Rank Math PRO 3.0.123 Malware: Updating Is Not Enough

Rank Math disclosed on October 16, 2026 that some copies of its premium WordPress plugin, Rank Math SEO PRO 3.0.123, shipped with malware. The Rank Math PRO malware reached sites that downloaded or auto-updated the plugin between 20:02 UTC on October 15 and 07:12 UTC on October 16. Wordfence tracks it as CVE-2026-111862 with a CVSS score of 9.8. Version 3.0.124 is clean, but installing it does not remove the backdoors, so any site that activated a tainted copy has to be treated as compromised.

What happened

Rank Math SEO PRO is the paid edition of the Rank Math SEO plugin. It is delivered from Rank Math's own servers into the rank-math-pro plugin folder, not from the WordPress.org repository. According to Rank Math's notice, as reported by SQ Magazine, BugShield and Bearmor, a limited number of customers received plugin files containing malware during an 11 hour window. The malicious code arrived inside the official download, which makes this a supply-chain compromise rather than a break-in on individual sites.

Rank Math removed the affected files and published 3.0.124 on October 16. Its public changelog lists 3.0.123 as released on October 7 and gives 3.0.124 the same two functional fixes, with no mention of the incident. Rank Math says it has records of which accounts downloaded an affected copy and is contacting them.

Two things are still unknown: how the malicious files got into Rank Math's distribution channel, and how many sites installed them. Rank Math has not published either.

Who is affected

The version number alone does not prove infection. Only packages obtained inside the window carry the malware, including copies pulled by automatic updates. A site that installed 3.0.123 on October 7 and stayed on it was not affected by this incident.

Rank Math splits exposure into three cases:

Installed and activated during the window: treat the site as compromised.
Installed but never activated: delete the plugin files, install 3.0.124 from your Rank Math account and run a security scan.
Downloaded but never installed: no compromise is indicated by the download alone.

The free Rank Math SEO plugin on WordPress.org is not named in the incident. Bearmor points out that the release cooldown and automated checks WordPress.org has applied since June 2026 cover repository plugins only, so premium plugins delivered from vendor servers sit outside them. That gap is the subject of our piece on why premium WordPress plugin updates need their own controls.

What the Rank Math PRO malware does

The malware itself is the vulnerability here: there is no bug to exploit, only code that runs once the plugin is active. Reports differ on whether to call it "exploited in the wild". SecurityOnline uses that label, while other write-ups say no widespread exploitation has been reported. In practice, every site that activated a tainted copy ran the malicious code.

Based on Rank Math's description, as relayed by the three outlets, the malicious files can:

Set up persistent access and communicate with the domain rank1cdn[.]com.
Create administrator accounts the owner did not add.
Recreate hidden backdoors when pages load, so deleting one file is not enough.
Expose WordPress passwords, database credentials, API keys and any other secret the web server can read.

This is the classic pattern of a trojanized software update: the update channel customers trust most becomes the delivery mechanism, and signatures on a firewall cannot stop a file the site itself requested from its vendor.

Indicators of compromise

Rank Math's notice lists these indicators (quoted by SQ Magazine, BugShield and Bearmor):

Outbound connections to rank1cdn[.]com
Rows in wp_options with option_name values _uf6qdn2hmm, t8krdk990phb or _np5pvf754c
Unknown administrators whose usernames start with wpsupport_ or whose email addresses end in @wp-mail[.]net
A file at wp-includes/class-wp-cache-util.php, which Rank Math says is not a real WordPress core file
.cache files containing PHP code, plus .htaccess rules that let .cache files run as PHP
System scheduled tasks for the web server user carrying the marker #ms6v46
Unexpected PHP files in wp-content/mu-plugins/, the uploads directory, other plugin folders, Rank Math's includes/ folder, and the inc/, includes/ and lib/ folders of non-default themes

Rank Math and Wordfence both caution that finding none of these does not prove a site is clean.

What to do now

Find out whether any of your sites run Rank Math SEO PRO, and check when 3.0.123 was installed or updated. Plugin update logs, backups and file timestamps help here. If Rank Math emailed you, assume you are in scope.
If a tainted copy was activated, restore site files and the database from a backup taken before 20:02 UTC on October 15, 2026. This is Rank Math's recommended route.
If no clean backup exists, delete the entire rank-math-pro folder (deactivating it is not enough), delete the three wp_options rows above, and ask your host or firewall team to block outbound traffic to rank1cdn[.]com. Then hunt for the remaining indicators and reinstall WordPress core, plugins and themes from trusted sources.
Rotate credentials even after a clean restore: WordPress user passwords, the security keys and salts in wp-config.php, database credentials, hosting control panel, FTP, SFTP and SSH logins, and payment, email and API keys stored in plugin settings.
Install 3.0.124 only by signing in at rankmath.com. Rank Math says it never sends login or download links by email, so treat any message offering one as phishing.

Our step-by-step guide on how to clean a backdoored WordPress site covers the hunt in order, including the WP-CLI checksum checks and what they cannot see. Rotating credentials on a host that still carries a backdoor wastes the effort, which is why we argue you should rebuild before you rotate credentials.

Anyone who manages client sites should also review two-factor authentication for every administrator and check SSH authorized keys and scheduled tasks for every system user on shared hosts, not only the web server account.

What to watch next

A root cause from Rank Math. The notice does not say whether a build server, a release account or the download infrastructure was breached. The answer decides whether other Rank Math releases need review.
The CVE record. As of October 19, CVE-2026-111862 has no public record on CVE.org, and CISA has not added it to the Known Exploited Vulnerabilities catalog.
More premium plugin incidents. BugShield links this to the BdThemes plugin supply-chain attack in August 2026, and the September Brevo breach that pushed a WordPress backdoor to 100,000 sites used a vendor's infrastructure the same way.