Rank Math PRO 3.0.123 shipped with a backdoor for a short period in October 2026. Attackers slipped malicious code into the official download and update channel, so sites picked it up through a normal plugin update. This guide shows you how to tell whether your site took the infected copy, how to remove the backdoor completely, and how to protect your site from the next poisoned plugin update.
Rank Math PRO 3.0.123 Malware (CVE-2026-111862) Explained
The infected files reached sites through Rank Math’s own servers, not through a flaw on individual sites.
Rank Math released a genuine 3.0.123 on October 7, 2026. Between 20:02 UTC on October 15 and 07:12 UTC on October 16, someone replaced that package with a tainted copy under the same version number. Any site that downloaded or auto-updated the PRO plugin inside that 11-hour window received the malware. In Indian time, the window ran from 01:32 IST to 12:42 IST on October 16.
Rank Math pulled the files and released a clean 3.0.124 once it found the problem. Wordfence tracks the incident as CVE-2026-111862 with a critical score of 9.8. You can read the vendor’s own security notice for its official wording.
The free Rank Math SEO plugin from WordPress.org is not part of this incident. Only the PRO add-on, which installs into the rank-math-pro folder and updates from rankmath.com, carried the malware.
What the Rank Math PRO Backdoor Does on Your Site
The malware does nothing until an administrator activates the plugin, and then it digs in hard.
After activation, the code contacts a command server at rank1cdn[.]com and sets up several ways to stay on the site:
- It plants hidden PHP backdoors and rebuilds them whenever a visitor loads a page.
- It creates new administrator accounts you never added.
- It drops a fake WordPress core file and PHP code hidden inside
.cachefiles. - It adds scheduled tasks and can add SSH keys on the server.
It also reads every secret the web server can reach. That includes WordPress passwords, the database login, API keys and payment gateway keys. Treat all of them as stolen if your site ran the infected copy.
Updating to 3.0.124 replaces the plugin folder only. It does not touch the backdoors, rogue accounts or cron jobs the malware placed elsewhere, which is why an update alone leaves the site infected.
Rank Math PRO Malware Indicators of Compromise (IOC Checklist)
Finding any one item in this table means you should treat the site as compromised, even if it now runs 3.0.124.
| Where to look | What to look for |
|---|---|
Database (wp_options) | Rows with option_name _uf6qdn2hmm, t8krdk990phb or _np5pvf754c |
| Network | Outgoing connections to rank1cdn[.]com |
| Users | Administrators with usernames starting wpsupport_, or emails ending @wp-mail[.]net |
| Core files | wp-includes/class-wp-cache-util.php, which is not a real WordPress file |
| Server config | .htaccess rules that let .cache files run as PHP, and .cache files containing PHP |
| Cron | Server crontab entries tagged #ms6v46, plus unknown WordPress scheduled events |
| Code patterns | base64_decode with XOR loops, the key xmmqhn, proc_open, or PHP-FPM socket code |
| Folders | Unknown PHP in wp-content/mu-plugins/, wp-content/uploads/, other plugins’ folders, and the inc/, includes/ and lib/ folders of non-default themes |
The named database rows, domain, usernames, fake core file and cron tag are specific to this attack. The code patterns are broader and can appear in legitimate plugins, so inspect a match before you delete anything.
Step 1: Check if Your Site Installed the Infected Rank Math PRO Update
The version number alone cannot tell you, so you need the date your copy arrived.
A site running 3.0.123 since October 7 is safe from this incident. Check these places to find when your copy landed:
- Plugins page history or your management dashboard (ManageWP, MainWP, InfiniteWP)
- The modified date on the
wp-content/plugins/rank-math-profolder in your hosting File Manager - Your backup tool’s change log
- Your inbox and spam folder, since Rank Math emailed the accounts that downloaded an affected copy
Agencies should check every client site with PRO on auto-update. An automatic update inside the window counts the same as a manual one.
Once you know the date, match your site to one of these cases:
| Your situation | What to do |
|---|---|
| Installed and activated during the window | Treat the site as compromised and follow every step below |
| Installed during the window but never activated | Delete the plugin folder, install 3.0.124 from your Rank Math account, run a malware scan |
| Downloaded the zip but never installed it | Delete the zip; no sign of compromise from this alone |
| Got 3.0.123 before October 15, 20:02 UTC | Not affected by this incident; update to 3.0.124 normally |
Step 2: Restore a WordPress Backup From Before October 15, 2026
A restore is the fastest and safest way back, and Rank Math recommends it first.
Pick a backup of both files and the database taken before 20:02 UTC on October 15, 2026. A backup from after that point may already carry the backdoor. Restore it, run a full scan with Wordfence or Sucuri, and change every credential listed in Step 6 before you reinstall Rank Math PRO.
If you restored successfully, skip to Step 6.
Step 3: Delete the rank-math-pro Folder and Malicious wp_options Rows
Do these three things first, because the malware recreates deleted files whenever someone visits the site.
- Delete the whole
rank-math-profolder through your hosting File Manager or FTP. Deactivating the plugin from the dashboard does not stop it. - Open phpMyAdmin, go to the
wp_optionstable (your prefix may differ), and delete the three rows listed in the IOC table above. - Ask your host or firewall provider to block outgoing traffic to
rank1cdn[.]com.
If you skip this order and start deleting backdoor files first, they can come straight back on the next page load.
Step 4: Remove Rogue Admins, Fake Core Files and Hidden PHP Backdoors
With the rebuild stopped, you can now remove the persistence the attacker planted. Use the IOC table to find each item.
Rogue administrator accounts
Go to Users and filter by Administrator, or run this WP-CLI command:
wp user list --role=administratorDelete every account that matches the IOC table, plus any other admin you do not recognize.
Fake core file
Delete wp-includes/class-wp-cache-util.php if it exists.
Hidden PHP files
Delete unknown PHP files from the folders listed in the IOC table. The safest move is to reinstall every plugin and theme from its official source.
.htaccess and .cache files
Open .htaccess and remove any rule that lets .cache files run as PHP. Then search the site for .cache files containing PHP code and delete them.
Cron jobs and SSH keys
List WordPress scheduled events with:
wp cron event listRemove any event you do not recognize. In your hosting panel, delete server crontab entries tagged #ms6v46, and remove any SSH key in authorized_keys that you did not add. On shared hosting, ask your host to check other users’ crontabs, running processes and writable folders outside the site.
Finding none of these markers does not prove your site is clean. The attacker may have used other tricks, so finish the remaining steps either way.
Step 5: Verify WordPress Core and Plugin Checksums With WP-CLI
Checksum tests confirm that WordPress core and free plugins match their official versions.
Run both commands over SSH:
wp core verify-checksums
wp plugin verify-checksums --allReinstall any file that fails. WordPress.org does not publish checksums for premium plugins like Rank Math PRO, so the check skips them. For those, delete the folder and install a fresh copy from the vendor’s account page.
Step 6: Rotate WordPress, Database and API Credentials
A restore or cleanup removes the malware, but it cannot take back secrets the attacker already copied.
Rotate all of these, even after a clean backup restore:
- Every WordPress user password
- The database username and password in
wp-config.php - The security keys and salts in
wp-config.php(generate new ones from the WordPress salt generator) - Payment gateway keys such as Stripe and PayPal
- SMTP and transactional email credentials
- API keys stored in plugin settings, including AI writing tools, rank trackers and analytics
- Hosting panel, FTP, SFTP and SSH logins
- Secrets stored in environment variables
Turn on two-factor login for every administrator while you are at it. Changing passwords on a server that still hides a backdoor wastes the effort, so finish Steps 3 to 5 before this one.
Step 7: Install the Clean Rank Math PRO 3.0.124 Update
Install the clean version last, and only from the official account page.
Log in directly at rankmath.com by typing the address yourself, then download 3.0.124. Some customers must reset their account password before they can log in. Rank Math never sends login or download links by email, so treat any such email as phishing.
Step 8: Check Google Search Console and Bing for SEO Damage
An attacker with admin access can quietly change what Google and Bing see, so run a quick SEO check after the security work.
- Open Security issues and Manual actions in Google Search Console and fix anything flagged.
- Under Settings > Users and permissions, remove any owner or verification token you do not recognize.
- Search
site:yourdomain.comwith spam words like casino, loan or pharma names to catch injected pages. - Review Rank Math’s Redirections module for rules you did not create.
- Check Bing Webmaster Tools for the same security warnings and unknown users.
Note the incident date in your analytics so you can separate cleanup effects from algorithm changes later.
How to Protect WordPress From Malicious Plugin Updates
This was not a one-off, so a few habits will limit the damage from the next one.
Rank Math PRO is at least the third premium WordPress plugin in 2026 whose vendor update channel delivered backdoored builds. Smart Slider 3 Pro and ShapedPlugin’s Pro plugins went through similar attacks earlier in the year. Firewall rules cannot stop these, because your site requests the bad file from a vendor it trusts.
- Delay premium plugin auto-updates by a few days. Most poisoned builds get caught and pulled within hours, so a short delay keeps you out of the window.
- Keep daily off-site backups with at least 30 days of history. A clean restore point turns a full incident into a short fix.
- Run a file-change monitor like Wordfence so you get an alert when new PHP files appear.
- Store as few secrets in plugin settings as possible, and give each API key the minimum permissions it needs.
- Remove premium plugins you no longer use, since every vendor update channel adds risk.
Frequently Asked Questions
Is the free Rank Math SEO plugin affected?
No. The incident covers only the Rank Math PRO add-on downloaded from rankmath.com. The free plugin on WordPress.org was not named in any advisory.
My site runs 3.0.123. Is it infected?
Not necessarily. Only copies downloaded or updated between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026 carried the malware. Check when your copy arrived before you decide.
Is updating to 3.0.124 enough?
No. The update replaces the plugin folder, but the backdoors, admin accounts and cron jobs sit elsewhere on the server. You must clean those out and rotate your credentials.
Can I just deactivate Rank Math PRO?
No. Rank Math says deactivation does not stop the malware. Delete the entire rank-math-pro folder instead.
What if I am not comfortable editing the database or server files?
Hand the job to your hosting provider or a WordPress security service. A half-finished cleanup that leaves the rebuild mechanism in place is worse than paying for a complete one.
Who was behind the attack?
Nobody has named the attacker yet. Rank Math has not explained how the malicious files entered its download system or how many sites received them.
