Malware in Rank Math PRO 3.0.123 installs self-rebuilding backdoors
Original title: Hackers Compromise Rank Math PRO WordPress Plugin to Install Self-Rebuilding Backdoors
Only packages downloaded from October 15 at 20:02 UTC to October 16 at 07:12 UTC were tainted; clean release is 3.0.124.
Rank Math said some Rank Math PRO 3.0.123 packages distributed in a limited October window contained malware that can compromise a site when the plugin is activated. The malware can recreate a hidden backdoor after a suspicious PHP file is deleted, and deactivating the plugin is not enough. The company removed the files and released clean version 3.0.124. The free Rank Math SEO plugin on WordPress.org is not affected. Rank Math called the impact limited but gave no count of affected sites.
Unconfirmed: Rank Math calls the impact limited but does not state how many sites were affected, and the article does not link this incident to earlier WordPress or BdThemes attacks.
- Affected downloads ran from October 15, 2026, 20:02 UTC to October 16, 07:12 UTC.
- Suspicious option names are _uf6qdn2hmm, t8krdk990phb, and _np5pvf754c.
- Fake core file wp-includes/class-wp-cache-util.php and accounts starting wpsupport_ are listed.
- Rank Math advises blocking outgoing connections to rank1cdn[.]com where possible.
- Sites that downloaded the package without installing or activating it are not treated as compromised.
Impact: Self-rebuilding backdoors and possible exposure of site secrets
| Product | Affected | Fixed in |
|---|---|---|
| Rank Math PRO | 3.0.123 packages from the stated October window | 3.0.124 |
- 1.Delete the rank-math-pro directory, remove the named options, and install 3.0.124.
- 2.Restore files and the database from a backup made before October 15, 2026, 20:02 UTC.
- 3.Block rank1cdn[.]com and replace WordPress, database, API, SMTP, payment, and hosting credentials.
- Vendors
- Rank Math
- Products
- Rank Math PRORank Math SEO
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | rank1cdn.com | ders or firewalls should also block outgoing connections to rank1cdn[.]com . The vendor identifies several places where hidden PHP f |
| domain | wp-mail.net | h usernames beginning wpsupport_ or email addresses ending @wp-mail[.]net . Rank Math also identifies wp-includes/class-wp-cache-ut |
From the original article
3 min read at cybersecuritynews.com
Hackers planted malware in copies of the Rank Math PRO WordPress plugin, exposing websites to hidden backdoors that can rebuild themselves after removal. Rank Math confirmed that some version 3. 0.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.