Rank Math PRO 3.0.123 contained malware: what WordPress site owners should do

Rank Math, the maker of one of the most widely used WordPress SEO plugins, says that for about eleven hours last week the paid Rank Math PRO download on its own website contained malware. Anyone who installed version 3.0.123 in that window and activated it should treat their site as compromised, because the code opens a backdoor that rebuilds itself and can reach the secrets the web server holds. The free plugin on WordPress.org is not affected.

Key points

• Rank Math PRO 3.0.123, downloaded from Rank Math's own site between 15 October 2026 at 20:02 UTC and 16 October at 07:12 UTC, contained malware.
• Only the paid PRO plugin is affected; Rank Math says the free version from WordPress.org is not.
• A site that activated 3.0.123 in that window should be treated as compromised; deactivating the plugin or updating to 3.0.124 does not remove what the malware planted.
• Rank Math describes a backdoor that talks to the domain rank1cdn[.]com and recreates itself when anyone visits the site; the company recommends blocking that domain.
• Rank Math has not said how many sites were affected or how the attackers got into its download system.

What happened

Rank Math published a security advisory saying the PRO package for version 3.0.123 served from its website between 20:02 UTC on 15 October and 07:12 UTC on 16 October contained malware. In its words, the files "contained malware that could compromise your website if the plugin was activated." The company says it removed the affected files and released a clean version, 3.0.124. BleepingComputer and SecurityWeek both reported the incident on 19 October.

Rank Math calls the affected group "a limited number of users" and has not published a figure. BleepingComputer says it asked the company for the number of affected sites and for the initial attack vector and had no reply when it published. The advisory also does not say how the compromise was detected.

According to the advisory, the malware gives attackers persistent access, communicates with rank1cdn[.]com and can recreate its hidden backdoor whenever someone visits the infected site. Installing it can expose database credentials, API keys and other secrets the web server can read.

Background

A supply-chain attack hits software at the point where it is distributed rather than where it is used. Site owners did nothing unusual: they downloaded a paid plugin from the vendor's official site, the one place they are told to trust. That is what makes this class of attack hard to defend against, and why it follows the same pattern as earlier incidents in which attackers tampered with a legitimate vendor's update path.

Rank Math's free plugin is active on more than four million websites, according to BleepingComputer. The PRO version is a separate, paid package that customers download from the vendor's site, which is why the free plugin's distribution on WordPress.org was untouched. The article we rely on gives no install count for PRO.

How it works

Rank Math's advisory lists indicators of compromise that site owners can check. The malware may:

• create a fake WordPress core file at wp-includes/class-wp-cache-util.php;
• create administrator accounts whose usernames start with wpsupport_ or whose email addresses end in @wp-mail[.]net;
• add three database options in wp_options named _uf6qdn2hmm, t8krdk990phb and _np5pvf754c;
• add scheduled tasks tagged #ms6v46;
• alter .htaccess so that .cache files run as PHP, and drop PHP into wp-content/mu-plugins/ or uploads/.

SecurityWeek adds that, per the advisory, the malware may modify other plugins and themes and make changes outside WordPress, such as editing SSH authorized_keys. Code markers listed by Rank Math include base64_decode combined with XOR loops, the key xmmqhn, and proc_open.

BleepingComputer separately examined a PHP file on VirusTotal that shares several of these indicators: an XOR key, a database entry, a cron marker and code that creates administrator accounts. It appears to be a first-stage script that writes the backdoor to the same fake core file path, and it can run commands, change databases and steal cloud credentials and SSH keys. BleepingComputer says it could not confirm the file was delivered through the plugin, and neither Rank Math nor Wordfence mentioned it, so treat it as a related sample, not proof.

What it means

The advice from Rank Math is blunt, and it is the part to act on.

First, work out whether you are exposed. Look in the WordPress Plugins screen. If 3.0.123 was activated during the window, treat the site as compromised. If it was installed but never activated, delete it, install 3.0.124 and run a scan. If it was downloaded but not installed, the advisory says this incident alone does not indicate compromise.

Preferred fix: restore. Restore files and database from a backup made before 20:02 UTC on 15 October, scan with a tool such as Wordfence or Sucuri, rotate every password, database credential and API key, and only then install 3.0.124.

Manual cleanup, if there is no backup. Delete the whole rank-math-pro folder (deactivating is not enough, the advisory says), remove the three database options, block rank1cdn[.]com, then hunt for the other changes listed above, reinstall core, plugins and themes from official sources, check server-level items such as SSH keys and other users' crontabs, rotate credentials and salts, and run wp core verify-checksums.

Rank Math adds that it will never send login or download links by email, a useful warning because incidents like this often prompt phishing that mimics the vendor's cleanup notices.

For agencies and hosts, the lesson is to keep an inventory of which sites run paid plugins from vendor sites rather than from the WordPress.org directory, since those never pass through the directory's own distribution.

What we don't know yet

• How many sites downloaded or activated 3.0.123. One outlet's headline mentions "several hundred" customers, but we could not open that article and Rank Math's advisory gives no number, so we treat it as unconfirmed.
• How the attackers modified the download. The advisory does not say.
• Who is behind it. Nobody has been named.
• Whether the VirusTotal sample BleepingComputer found is the same payload as the one in the plugin.

What to watch next

Expect a fuller post-mortem from Rank Math with the number of affected sites and the entry point, and updated detections from security vendors such as Wordfence. Also watch for secondary compromise: credentials stolen from an infected site can be used to reach cloud accounts and other sites long after the plugin is cleaned.

Sources

• Rank Math PRO 3.0.123 security incident, Rank Math (primary)
• WordPress SEO plugin Rank Math compromised to backdoor websites, BleepingComputer, 19 October 2026
• Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack, SecurityWeek, 19 October 2026