An alarming security incident has affected users of **Rank Math PRO**, the popular SEO plugin for **WordPress**. Copies of the plugin, specifically version 3.0.123, downloaded or updated from rankmath.com during a specific window—between 20:02 UTC on October 15 and 07:12 UTC on October 16—contained sophisticated malware. **Rank Math** confirmed the breach in a [security notice](https://rankmath.com/kb/pro-3-0-123-security-incident/) on October 16, advising that any site installing and activating these tainted versions should be considered compromised. The malware is designed to persist, capable of recreating its hidden backdoor upon site visits. **Rank Math** has since removed the compromised files and released a clean version, 3.0.124. However, merely updating the plugin is insufficient for full recovery, as the malware may have established persistence through other means, as highlighted by **Wordfence** in their [advisory](https://www.wordfence.com/blog/2026/10/rank-math-seo-pro-3-0-123-malware/).  ## Who Is Affected? It's crucial to understand that the version number alone doesn't indicate compromise. Version 3.0.123, dated October 7 in the **Rank Math** [changelog](https://rankmath.com/changelog/pro/v3-0-123/), was only malicious if downloaded or updated during the specified window. **Rank Math** outlines three scenarios: * **Installed and Activated during the window:** Treat your site as compromised, even if updated to 3.0.124. Follow the extensive recovery steps. * **Installed but never activated:** Delete the plugin files, install 3.0.124 from your **Rank Math** account, and run a security scan. * **Downloaded but never installed or activated:** This incident alone does not indicate compromise. **Rank Math** has notified some users via email and encourages those unsure about their status to contact their support team. This incident specifically impacts the **PRO** plugin, which is downloaded directly from rankmath.com, not the [free **Rank Math SEO** plugin](https://wordpress.org/plugins/seo-by-rank-math/) available on WordPress.org. ## What the Malware Does Details on the malware's exact code are limited, as neither **Rank Math** nor **Wordfence** has published a full analysis. However, the potential impact is severe. The malware can establish a persistent backdoor, often by recreating itself, making simple file deletion ineffective. Attackers may have: * Left PHP backdoor files in other plugin or theme folders, and in the `must-use` plugins directory. * Created unauthorized administrator accounts. * Injected a fake WordPress core file (e.g., `wp-includes/class-wp-cache-util.php`). * Modified `.htaccess` to execute `.cache` files as PHP. * Added scheduled tasks and **SSH** keys. Any sensitive data accessible by the site, including passwords, database credentials, and **API** keys, should be assumed compromised. **Wordfence** has assigned the incident **CVE-2026-111862**, rating it a critical 9.8 out of 10. **Patchstack** also classifies it as a backdoor, noting that due to the attack on **Rank Math**'s systems, traditional rule-based mitigation is not possible. ## How to Recover **Rank Math**'s primary recommendation is to restore from a clean backup created *before* 20:02 UTC on October 15. After restoration, conduct a security scan, change all passwords and credentials, and then install the clean 3.0.124 version. If a clean backup is unavailable, a meticulous manual cleanup is necessary, following a specific order: 1. **Delete the `rank-math-pro` plugin folder entirely** via hosting file manager or **FTP**. Deactivating is not enough. 2. **Delete specific entries in the `wp_options` table** with `option_name` values: `_uf6qdn2hmm`, `t8krdk990phb`, or `_np5pvf754c`. 3. **Block outgoing connections to `rank1cdn[.]com`** if your hosting provider or firewall allows. Only after these initial steps should you proceed to search for other compromises: * **Files:** Look for suspicious PHP files in `wp-content/mu-plugins/`, other plugin folders, `inc/`, `includes/`, and `lib/` folders of non-default themes, **Rank Math**'s `includes/` folder, and `uploads/`. * **Code:** Identify PHP code using `base64_decode` with **XOR** loops, the key `xmmqhn`, `proc_open`, or **PHP-FPM** socket code. * **File:** Check for `wp-includes/class-wp-cache-util.php`, which is not a legitimate WordPress core file. * **Accounts:** Look for administrator usernames starting `wpsupport_` or accounts with email addresses ending `@wp-mail[.]net`. * **Server:** Scrutinize `.htaccess` for rules allowing `.cache` files to run as PHP, `.cache` files containing PHP code, **crontab** entries tagged `#ms6v46`, WordPress scheduled events, **SSH** `authorized_keys` files, other users' **crontabs**, running processes, and any external writable locations. **Wordfence** cautions that the *absence* of these indicators does not definitively prove a site is clean. Crucially, all credentials must be changed, even after a backup restore. This includes WordPress passwords, database credentials in `wp-config.php`, security keys and salts, **API** keys (payment gateways, **SMTP**), hosting control panel, **FTP**, **SFTP**, **SSH** access, environment variables, and administrator two-factor authentication. The cleanup concludes with a security scan and `wp core verify-checksums` for WordPress core, along with `wp plugin verify-checksums --all`. Note that checksums for premium plugins like **Rank Math PRO** may not be publicly available. The clean 3.0.124 version should be downloaded directly from rankmath.com as the final step. ## What Rank Math Has Not Said **Rank Math**, part of the Swedish hosting group **group.one**, has yet to disclose critical details, including how the malicious files infiltrated its systems, the number of affected customers, whether automatic updates delivered the malware, or the hashes of the compromised and clean packages. Their only statement regarding future prevention is a commitment to reduce similar risks. Notably, registry records show the domain `rank1cdn[.]com`, which **Rank Math** advises blocking, was registered on October 14 (19:31 UTC), roughly a day before the incident window opened. ## A Pattern of Supply Chain Attacks This incident is not isolated. It marks at least the third time this year that a premium **WordPress** plugin's vendor-run update channel has distributed backdoored builds. In April, **Nextend**'s update system served a compromised **Smart Slider 3 Pro** for approximately six hours. In June, **ShapedPlugin**'s **Pro** plugins were found backdoored via their update channel, with one package even tampered with under the same version number post-release. Other incidents include attackers altering scripts from **Awesome Motive**'s **CDN** in June and poisoning **BdThemes**' **API** feed in August. While these events share a concerning pattern of supply chain compromise, no definitive links between the attackers have been published.