Some Rank Math SEO PRO 3.0.123 downloads included malware that can backdoor WordPress sites and steal credentials.
Wordfence reports that Rank Math found malware in some Rank Math SEO PRO 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. The issue is tracked as CVE-2026-111862 with CVSS 9.8. If activated, the code can recreate hidden PHP backdoors, add administrator accounts and cron jobs, contact rank1cdn[.]com, and expose WordPress, database, and API credentials. Rank Math pulled the files and shipped clean version 3.0.124; updating alone does not remove an existing compromise.
Malicious packages were available from Oct 15 20:02 UTC to Oct 16 07:12 UTC.
CVE-2026-111862 is rated CVSS 9.8; clean release is 3.0.124.
Backdoors, rogue admins, cron jobs, and rank1cdn[.]com contact are described.
Activated sites need a pre-incident restore and full credential rotation.
Having version 3.0.123 outside that window does not prove compromise.
PSA: Malware Found in Some Rank Math SEO PRO 3.0.123 Downloads
Rank Math has disclosed that some copies of Rank Math SEO PRO version 3.0.123 contained malware. According to Rank Math, the affected version was downloaded or installed through an update between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC.
If an affected copy of Rank Math SEO PRO 3.0.123 was active on your website, you should treat the website as compromised. Simply updating the plugin is not enough because the malware may have placed additional files, administrator accounts, or scheduled tasks elsewhere on the server.
Rank Math removed the affected files and released version 3.0.124 as the clean replacement. Version 3.0.123 by itself does not prove that a website was compromised: Rank Math limits the incident to users who downloaded or updated to the affected version during the stated period.
Website owners should check when version 3.0.123 was downloaded or installed, follow the recovery guidance below, and use Rank Math’s security notice as the authoritative source for updates about this incident.
Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a website if the plugin was activated and directs sites that activated an affected package to treat the website as compromised. The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server. Rank Math identifies three malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker as incident indicators. Only packages obtained during the vendor-confirmed window are claimed as affected; version 3.0.123 alone is not sufficient to establish compromise. Rank Math removed the affected files and released version 3.0.124 as the clean replacement.
Your website may be affected if it downloaded or updated to Rank Math SEO PRO 3.0.123 during the following period:
Start: October 15, 2026 at 20:02 UTC
End: October 16, 2026 at 07:12 UTC
Rank Math provides the following guidance:
If you installed and activated an affected copy of version 3.0.123, treat the website as compromised and complete a full recovery.
If you installed version 3.0.123 but never activated it, delete the affected plugin files, install version 3.0.124 from your Rank Math account, and run a security scan.
If you downloaded version 3.0.123 but never installed or activated it, Rank Math says there is no indication from this incident alone that your website was compromised.
Rank Math says it has records identifying users who downloaded an affected copy. If Rank Math notified you, follow its recovery instructions even if your website is now running a different version.
What Website Owners Should Do Now
If an affected copy was activated, Rank Math recommends restoring the website and its database from a clean backup created before October 15, 2026 at 20:02 UTC. After restoring the backup, scan the website, replace passwords and other sensitive credentials that the website could access, and then install Rank Math SEO PRO 3.0.124 directly from your Rank Math account.
If a suitable backup is not available, Rank Math advises having the website cleaned manually. This work should be performed by an experienced security professional or hosting provider if you are not comfortable working with website files, the database, and server settings.
Before removing other suspicious files, complete the following steps to prevent the malware from recreating its hidden backdoor when someone visits the website:
Delete the entire rank-math-pro plugin folder. Deactivating the plugin is not enough.
Delete any entry in the WordPress wp_options database table whose option_name is _uf6qdn2hmm, t8krdk990phb, or _np5pvf754c.
Block outgoing connections to rank1cdn[.]com if your hosting provider or firewall supports it.
Once the mechanism that recreates the malware has been disabled, check the rest of the website and server for the signs listed below. Reinstall WordPress, plugins, and themes from trusted sources where appropriate.
Changing passwords is essential even if the site is restored from a backup. Rank Math recommends replacing WordPress passwords, database credentials, WordPress security keys and salts, payment and email service credentials, API keys, hosting control-panel credentials, and FTP, SFTP, or SSH credentials that may have been accessible to the website. Review two-factor authentication settings for administrator accounts as well.
What the Malware Can Do
Rank Math states that the affected plugin files contained malware that could compromise a website when the plugin was activated. The company warns that the malware can recreate a hidden backdoor when the website is visited and that the attacker may have left additional files, unauthorized administrator accounts, scheduled tasks, or server-level changes behind.
Rank Math advises site owners to assume that credentials and secrets accessible to the compromised website may have been exposed. This includes WordPress passwords, database credentials, API keys, and other stored secrets. Updating to version 3.0.124 replaces the affected Rank Math package, but it does not remove files, accounts, or scheduled tasks that the malware may already have created elsewhere.
Indicators of Compromise
The following signs come from Rank Math’s security notice. Their presence should be investigated. Their absence does not, by itself, prove that a website is clean.
Network Activity
Outgoing connections to rank1cdn[.]com
WordPress Database
An entry in the wp_options table named _uf6qdn2hmm
An entry in the wp_options table named t8krdk990phb
An entry in the wp_options table named _np5pvf754c
Administrator Accounts
Unknown administrator usernames beginning with wpsupport_
Unknown accounts using an email address ending in @wp-mail[.]net
Files and Server Changes
wp-includes/class-wp-cache-util.php. Rank Math states that this is not a legitimate WordPress core file.
PHP files in unexpected locations, including wp-content/mu-plugins/, folders belonging to other plugins, the inc/, includes/, and lib/ folders of non-default themes, and the Rank Math includes/ folder.
Suspicious PHP code containing base64_decode with XOR loops, the key xmmqhn, proc_open, or PHP-FPM socket code.
Rules in a root or subdirectory .htaccess file that allow .cache files to run as PHP.
.cache files containing PHP code.
System scheduled tasks for the web server user containing the marker #ms6v46.
Unexpected PHP files in the WordPress uploads directory.
Rank Math also recommends reviewing WordPress scheduled events, SSH authorized keys, scheduled tasks belonging to other system users, running processes, and locations outside the website directory where the web server can write files.
How to Verify the Website After Cleanup
After recovery, run a full security scan and continue watching the website for unusual behavior. Rank Math specifically recommends checking WordPress core files with:
wp core verify-checksums
Plugin files can be checked with:
wp plugin verify-checksums --all
Checksums are not available for every premium plugin, so compare those files with a clean copy downloaded directly from the developer. Monitor outgoing connections and confirm that removed files do not return. If suspicious files reappear, the cleanup is incomplete.
Download Rank Math SEO PRO 3.0.124 by navigating directly to rankmath.com and signing in to your account. Rank Math says it will not send login or download links by email, so treat unexpected messages containing those links as suspicious.
Timeline
October 15, 2026 at 20:02 UTC: The affected download and update period began.
October 16, 2026 at 07:12 UTC: The affected period ended.
October 16, 2026: Rank Math published its security notice and directed affected users to install the clean version, 3.0.124, after completing the appropriate recovery steps.
Conclusion
Rank Math says this incident affected a limited number of users who downloaded or updated to Rank Math SEO PRO 3.0.123 during a specific period. Version 3.0.123 alone is not evidence that a website was compromised. However, any website on which an affected copy was active should be treated as compromised.
If your site may be affected, first establish when version 3.0.123 was obtained. If an affected copy was active, restore the website and database from a clean backup created before the incident whenever possible. If no suitable backup is available, follow Rank Math’s manual-cleanup steps in the stated order. In either case, replace exposed credentials and other secrets, install the clean version 3.0.124, scan the full website and server, and monitor for signs that the malware has returned.
Wordfence Care and Wordfence Response customers can contact our team for help investigating and cleaning a compromised website. Our incident response team can identify and remove malware, help determine the cause of an infection, and assist with the recovery process. Learn more about Wordfence Care and Wordfence Response.
Search
Leave Your Security to Us with
Wordfence Care
All the benefits of Wordfence Premium plus hands on installation, configuration and optimization as well as security monitoring and incident response. Trust your site to us with Wordfence Care, and get back to business.
All comments are moderated before being published. Inappropriate or off-topic comments may not be approved.
Breaking WordPress Security Research in your inbox as it happens.
This website uses cookies, pixels, and similar technologies (collectively “Cookies”) to improve your browsing experience. By clicking “Accept All”, you agree to the storing of Cookies on your device and that we may share, track, store, and analyze your interactions with the website to enhance site navigation, analyze site usage, and assist in our marketing efforts. For more information on our use of cookies please review our Cookie Policy.
Cookie Settings Accept All Reject All
Cookie Options
For additional information on how this site uses cookies, please review our Privacy Policy. The cookies used by this site are classified into the following categories and can be configured below.
Strictly Necessary
Always active
The “Strictly Necessary” cookies are necessary for the Sites and Services to work properly, and cannot be disabled. They include any essential authentication and authorization cookies for the Services. If you select the “Reject All” button, or choose to do nothing, only the strictly necessary cookies are active by default.
Functional
Disabled via "Do Not Sell or Share My Information" request. This category cannot be enabled.
Your browser is sending a Global Privacy Control signal which automatically disables this category. You may change your browser settings to enable it.
These cookies allow us to remember choices you make, such as your username, language, or region. This helps provide a more personalized and consistent experience by tailoring the Services to your preferences. For example, we can remember your preferred settings or login details, so you don't have to re-enter them each time you visit.
Performance/Analytical
Disabled via "Do Not Sell or Share My Information" request. This category cannot be enabled.
Your browser is sending a Global Privacy Control signal which automatically disables this category. You may change your browser settings to enable it.
These Cookies allow us to collect certain information about how you navigate the Sites or utilize the Services running on your device. They help us understand which areas you use and what we can do to improve them.
Targeting
Disabled via "Do Not Sell or Share My Information" request. This category cannot be enabled.
Your browser is sending a Global Privacy Control signal which automatically disables this category. You may change your browser settings to enable it.
These Cookies are used to deliver relevant information related to the Services to an identified machine or other device (not a named or otherwise identifiable person) which has previously been used to visit our Sites. Some of these types of Cookies on our Sites are operated by third parties with our permission and are used to identify advertising sources that are effectively driving customers to our Sites.
Cancel Save
Do Not Sell or Share My Personal Information
This form enables you to request that we stop selling or sharing your personal information with third parties. "Selling" includes exchanging your information for money or other benefits, while "sharing" refers to providing your data to third parties for targeted advertising purposes. For more information on how we process personal information, please review our Privacy Notice.
When you submit this form, we will:
Immediately disable retargeting and remarketing cookies on your current browser/device
Browser/Device Specific: This opt-out applies to the specific browser from which you submit the request. To opt out on additional devices or browsers, you will need to submit separate requests.
Cookie Management: You may also manage cookies directly through your browser settings, or on our Cookie Control form.
Do Not Sell or Share My Personal Information
Stop selling personal information about me to third parties for monetary or other valuable consideration.
Stop sharing personal information about me with third parties for cross-context behavioral advertising.
Your request has been received. We will no longer share or sell your personal information on this browser.
Cancel Submit
An error occurred while attempting to submit your request. Please try again or contact support.
Alex Thomas
