Copies of Rank Math PRO downloaded from rankmath.com or installed as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a security notice published on October 16. Rank Math removed the affected files and released a clean build, 3.0.124, but both Rank Math and Wordfence warn that simply installing the clean plugin does not guarantee a site is no longer compromised.
Who is affected and how to tell
The incident applies only to Rank Math PRO, the paid plugin customers download and update from rankmath.com; the free Rank Math SEO plugin on WordPress.org — which lists more than 4 million active installations and was last updated on October 6 — is not named in the notice. The version number alone does not indicate compromise: Rank Math’s changelog shows 3.0.123 dated October 7, more than a week before the malicious window.
Rank Math’s notice divides site owners into three cases: if 3.0.123 was installed and activated during the window, treat the site as compromised even if it has since been updated to 3.0.124; if it was installed but never activated, delete the plugin files, install 3.0.124 from the Rank Math account and run a security scan; and if the package was downloaded but never installed or activated, nothing in this incident alone indicates compromise. Rank Math has emailed some users and told anyone unsure whether files were installed or activated to contact its support team.
What the malware does
Rank Math’s notice — echoed by Wordfence’s advisory on October 17 — says the malicious build contains a hidden backdoor that can be recreated whenever someone visits a compromised site. The attacker may have placed PHP backdoor files not only in the Rank Math plugin folder but also in other plugins’ folders, theme folders, and the must-use plugins directory. Additional changes the notice lists include creation of administrator accounts, addition of a fake WordPress core file, modification of .htaccess so .cache files run as PHP, and placement of scheduled tasks and SSH keys.
Any password, database credential, API key or other secret the site can reach may have been exposed; Rank Math and Wordfence advise owners to assume secrets were compromised. Wordfence lists the researcher as unknown for CVE-2026-111862. Patchstack classifies the incident as a backdoor and notes that, because the attack was on Rank Math’s own systems, “a rule is not possible for mitigation.”
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildHow to recover, according to Rank Math and Wordfence
Rank Math’s preferred recovery is a restore from a backup taken before 20:02 UTC on October 15. Where such a clean backup exists, the vendor advises restoring the site and database, running a security scan, changing every password and credential, and only then installing 3.0.124 from a Rank Math account.
Where no clean backup exists, Rank Math prescribes a fixed-order manual cleanup. The three actions that must precede everything else are:
- Delete the entire rank-math-pro plugin folder via hosting file manager or FTP — deactivating alone is not sufficient.
- In the wp_options table, delete any entry whose option_name is _uf6qdn2hmm, t8krdk990phb or _np5pvf754c.
- Block outgoing connections to rank1cdn[.]com if the hosting provider or firewall allows it.
Only after those steps should owners search for other malicious changes: PHP files in wp-content/mu-plugins/, other plugins’ folders, non-default theme inc/includes/lib folders, Rank Math’s includes/ folder, and uploads/; PHP code using base64_decode with XOR loops keyed by xmmqhn, proc_open or PHP-FPM socket code; the file wp-includes/class-wp-cache-util.php (not a WordPress core file); administrator accounts beginning wpsupport_ or accounts with @wp-mail[.]net email addresses; .htaccess rules and .cache files that run as PHP; cron entries tagged #ms6v46; WordPress scheduled events; SSH authorized_keys and other crontabs; running processes; and any location outside the site where the web server is able to write.
Wordfence cautions that absence of these artifacts “does not, by itself, prove that a website is clean.” The final steps Rank Math lists are a comprehensive credential reset — WordPress passwords; database username and password in wp-config.php; security keys and salts; payment gateway, SMTP and other API keys; hosting control panel, FTP/SFTP/SSH credentials; environment-variable secrets; and two-factor authentication for administrators — followed by a security scan and verification of WordPress core and plugin checksums where available. Rank Math notes its clean 3.0.124 must be downloaded by logging in at rankmath.com; it will never send download links by email.
What Rank Math has not said and related signals
Rank Math, which is part of the Swedish hosting group group.one, has not disclosed how malicious files entered its download and update system, how many customers received tainted builds, whether automatic updates delivered them, or the hashes of clean and tainted packages. Registry records show the domain Rank Math tells owners to block, rank1cdn[.]com, was registered at 19:31 UTC on October 14, about a day before the window opened.
This is at least the third instance this year in which a vendor-run premium plugin update channel delivered backdoored builds: Nextend’s Smart Slider 3 Pro in April, ShapedPlugin’s Pro plugins in June (including a later tampering under the same version number), and other supply-chain alterations such as scripts from Awesome Motive’s CDN in June and a poisoned BdThemes API feed in August. Published reports do not link the actors behind those incidents to this Rank Math compromise.
What this means for security teams, hosting providers, and site owners
- Security teams: Expect that installing the clean plugin is not a sufficient remediation; plan for credential resets, full scans, and hunts for PHP backdoors in non-obvious locations described by Rank Math and Wordfence.
- Hosting providers and firewalls: The notice highlights blocking outbound connections to rank1cdn[.]com and checking web-server writable locations, crontabs, and authorized_keys — places hosts can inspect or restrict.
- Site owners and administrators: If you installed and activated Rank Math PRO between 20:02 UTC on October 15 and 07:12 UTC on October 16, treat the site as compromised and follow the ordered cleanup or restore steps Rank Math published.
Links and sources: The Hacker News — Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor
