Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a security notice published on October 16.
Any site that installed and activated one of those copies should be treated as compromised, and the malware can recreate its hidden backdoor whenever someone visits the site.
Rank Math has removed the affected files and released a clean version, 3.0.124. Installing it replaces the plugin but does not remove files, administrator accounts, or scheduled tasks the malware may already have placed elsewhere on the server, Wordfence said in an advisory on October 17.
Who Is Affected
The version number does not show whether a copy is affected. Rank Math's changelog dates 3.0.123 to October 7, more than a week before the window opened, and the notice limits the incident to copies downloaded or installed through an update during the window.
A copy of 3.0.123 obtained before 20:02 UTC on October 15 is outside it.
The notice sorts sites into three cases:
- You installed and activated 3.0.123 during the window: treat the site as compromised, even if it has since been updated to 3.0.124, and follow the recovery steps below.
- You installed it but never activated it: delete the plugin files, install 3.0.124 from your Rank Math account, and run a security scan.
- You downloaded it but never installed or activated it: nothing in this incident alone indicates the site was compromised.
Rank Math has emailed some users about the incident and told anyone unsure whether the files were installed or activated to contact its support team.
The notice applies only to the PRO plugin, which customers download and update from rankmath.com rather than WordPress.org. The free Rank Math SEO plugin on WordPress.org, which lists more than 4 million active installations and was last updated on October 6, is not named in it.
What the Malware Does
What is known about the malware comes from Rank Math's notice. Neither it nor Wordfence's advisory includes an analysis of the code, and neither names who is behind it.
Deleting suspicious files before stopping what recreates the backdoor may not resolve the problem, which is why the cleanup order below matters. The attacker may also have left PHP backdoor files in other plugins' folders, in theme folders, and in the must-use plugins directory, created administrator accounts, added a fake WordPress core file, changed .htaccess so that .cache files run as PHP, and added scheduled tasks and SSH keys.
Any password, database credential, API key, or other secret the site could reach may have been exposed, and owners should assume it was.
Wordfence assigned the incident CVE-2026-111862 and rates it 9.8 out of 10, with the researcher listed as unknown.
Patchstack classifies it as a backdoor and says that, because the attack was on Rank Math's own systems, "a rule is not possible for mitigation."
How to Recover
Rank Math's preferred recovery is a restore. Where a backup of the site and its database from before 20:02 UTC on October 15 exists, restore it, run a security scan, change every password and credential, and only then install 3.0.124 from your Rank Math account.
Where no clean backup exists, the manual cleanup runs in a fixed order, and three actions come before anything else is touched:
- Delete the entire rank-math-pro plugin folder using the hosting file manager or FTP. "Deactivating the plugin alone is not sufficient," the notice says.
- In the wp_options table, delete any entry whose option_name is _uf6qdn2hmm, t8krdk990phb or _np5pvf754c.
- Block outgoing connections to rank1cdn[.]com if the hosting provider or firewall allows it.
Only then does the search for other changes begin, in these places:
- Files: PHP files in wp-content/mu-plugins/, in other plugins' folders, in the inc/, includes/ and lib/ folders of non-default themes, in Rank Math's own includes/ folder, and in uploads/.
- Code: PHP that uses base64_decode with XOR loops, the key xmmqhn, proc_open, or PHP-FPM socket code.
- File: wp-includes/class-wp-cache-util.php, which is not a WordPress core file.
- Accounts: administrator usernames beginning wpsupport_, or accounts with email addresses ending @wp-mail[.]net.
- Server: .htaccess rules that let .cache files run as PHP, .cache files containing PHP code, entries tagged #ms6v46 in the web server user's crontab, WordPress scheduled events, SSH authorized_keys files, other users' crontabs, running processes, and any location outside the site where the web server can write.
Wordfence adds a caution: "Their absence does not, by itself, prove that a website is clean."
Credentials are changed in every case, even after a restore from backup. The list covers WordPress passwords, the database username and password in wp-config.php, the security keys and salts in the same file, payment gateway, SMTP and other API keys, hosting control panel, FTP, SFTP and SSH access, secrets held in environment variables, and two-factor authentication for administrators.
The cleanup ends with a security scan, wp core verify-checksums for WordPress core, and wp plugin verify-checksums --all, with the caution that checksums may not exist for premium plugins.
WordPress.org publishes none for this one. The Hacker News checked its plugin-checksums service on October 19 and found no file for the PRO plugin under either of its names, while the service does publish one for the free plugin. The fallback notice provides a clean copy from the official source.
The clean 3.0.124 goes on last, downloaded by logging in at rankmath.com directly. Some customers may be unable to log in and may need to reset their account password, the notice says, without saying why, and Rank Math will never send login or download links by email.
What Rank Math Has Not Said
Rank Math, part of the Swedish hosting group group.one, has not said how the malicious files entered its download and update system, how many customers received one, whether automatic updates delivered them, or what the clean and tainted packages' hashes are. Its only statement about the future is that the team is taking steps to reduce the risk of similar incidents.
Registry records show the domain Rank Math tells owners to block, rank1cdn[.]com, was registered at 19:31 UTC on October 14, about a day before the window opened.
A Pattern This Year
This is at least the third time this year that a premium WordPress plugin's vendor-run update channel has delivered backdoored builds. In April, Nextend's update system served a backdoored Smart Slider 3 Pro for about six hours.
In June, ShapedPlugin's Pro plugins were found to have been backdoored in its update channel, and one package that had shipped clean was later "tampered with under the same version number," the trap Rank Math's customers now face.
Attackers also altered scripts served from Awesome Motive's CDN in June and poisoned BdThemes' API feed in August. Nothing published links the attackers behind any of those incidents to this one.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.