For just over 11 hours in October 2026, the official download and update channel for Rank Math PRO handed out a Rank Math PRO backdoor instead of a clean SEO plugin. If your site installed and activated one of those copies, Rank Math’s advice is blunt: treat the whole site as compromised, even if you have already updated.
Here is what happened, how to tell whether you were hit, and the cleanup order that actually works against malware that rebuilds itself.
Key takeaways
- Rank Math PRO copies downloaded from rankmath.com or delivered as updates between 20:02 UTC on 15 October 2026 and 07:12 UTC on 16 October 2026 contained malware.
- The issue is tracked as CVE-2026-111862 and scored 9.8 out of 10 (critical).
- The free Rank Math SEO plugin on WordPress.org is not named in the notice.
- Updating to the clean 3.0.124 release does not remove the backdoor. Restoring a backup from before the window is the preferred fix.
- Assume every password, database credential and API key on an affected site has been exposed.
What happened to Rank Math PRO?
This was a supply chain attack: instead of breaking into thousands of websites one by one, attackers poisoned the place those websites get their software from. Rank Math published a security notice on 16 October 2026, Wordfence followed with an advisory on 17 October, and The Hacker News reported the incident in detail on 19 October.
The tainted builds carried the version number 3.0.123. According to SecurityWeek, Rank Math said: “We immediately removed the affected files and released a clean version, Rank Math PRO v3.0.124.”
Rank Math belongs to the Swedish hosting group group.one. It has not said how the malicious files got into its download system, how many customers received them, or who was behind it.
Is my site affected? Check the timestamp, not the version
This is the confusing part. Version 3.0.123 was first dated 7 October 2026 in the changelog, so a 3.0.123 copy you got before 20:02 UTC on 15 October is clean. The number on your plugins page proves nothing on its own. What matters is when the file reached your server.
| Your situation (copy obtained inside the window) | Status | What Rank Math says to do |
|---|---|---|
| Installed and activated | Compromised | Restore a pre-window backup or do a full manual cleanup, then rotate every credential |
| Installed, never activated | Exposed files, likely not running | Delete the plugin files, install 3.0.124, run a security scan |
| Downloaded, never installed | No sign of compromise from this incident | Delete the ZIP and download 3.0.124 from your account |
Rank Math has emailed some customers. If you are unsure, contact its support team. And note that Rank Math says it never sends login or download links by email, so treat any such message as a phishing attempt.
Why a self-restoring backdoor is so hard to remove
A backdoor is hidden code that lets an attacker get back in whenever they like. This one goes further: it can recreate itself when someone simply visits the site. Think of pulling up a weed while the root keeps sending up new shoots. Delete the visible files first and they may be back on the next page load.
According to the notice and security advisories, the malware may plant:
- PHP backdoor files in other plugins, theme folders and the mu-plugins (must-use plugins) directory
- A fake core file at wp-includes/class-wp-cache-util.php
- .htaccess rules that make .cache files run as PHP code
- Rogue administrator accounts with usernames starting with wpsupport_ or emails ending in @wp-mail[.]net
- Cron jobs (scheduled tasks), including crontab entries tagged #ms6v46, plus SSH keys
- Three database options in wp_options: _uf6qdn2hmm, t8krdk990phb and _np5pvf754c
It may also talk to rank1cdn[.]com, a domain registered at 19:31 UTC on 14 October 2026, less than a day before the bad builds went out. Wordfence also warns that finding none of these signs does not prove a site is clean.
How to clean up, in the right order
If you have a full backup of files and database from before 20:02 UTC on 15 October 2026, restore it, run a security scan, change every credential, then install 3.0.124 by logging in directly at rankmath.com. That is the simplest and safest route.
No clean backup? Do these three things first, before anything else:
- Delete the entire rank-math-pro folder over FTP or your host’s file manager. Deactivating it is not enough.
- Delete the three wp_options entries listed above.
- Block outgoing connections to rank1cdn[.]com, if your host or firewall allows it.
Then hunt through the other locations: themes, plugins, uploads, user accounts, crontabs and SSH authorized_keys. Run wp core verify-checksums to check WordPress core files. Plugin checksums will not help here, because WordPress.org publishes none for the PRO plugin.
Finally, rotate everything: WordPress passwords, the database password and security salts in wp-config.php, payment, email and other API keys, and hosting, FTP and SSH logins. Turn on two-factor authentication for every admin.
Is this part of a bigger pattern?
It is at least the fifth premium WordPress update channel to be abused in 2026. In April, Nextend’s update system served a backdoored Smart Slider 3 Pro for about six hours. In June, ShapedPlugin’s Pro plugins and scripts on Awesome Motive’s CDN were hit, and in August attackers poisoned BdThemes’ API feed. No published source links these incidents to each other.
My take, clearly as opinion: premium plugins sit outside WordPress.org’s checksum system, so customers have no independent way to confirm a file is genuine. Until vendors publish signed releases or hashes, a paid plugin’s update server is a single point of failure for every site that trusts it.
What happens next
The big unanswered questions are how the attackers got in, how many customers got the bad builds, whether automatic updates pushed them out, and what the clean and tainted file hashes are. Rank Math has said only that it is “taking steps to reduce the risk of similar incidents.”
The CVE record was published on 19 October 2026 and, according to Strix’s CVE summary, was still awaiting NVD analysis. Expect fuller technical write-ups from security firms, and possibly new indicators, in the weeks after.
FAQ
Is the free Rank Math SEO plugin affected?
Only Rank Math PRO is named in the notice. The free plugin on WordPress.org, with more than 4 million active installs, is not mentioned.
Does updating to Rank Math PRO 3.0.124 fix it?
No. The update replaces the plugin but leaves backdoor files, rogue admins and scheduled tasks elsewhere on the server. You need a pre-window backup or a full manual cleanup.
I have 3.0.123 installed. Am I compromised?
Not necessarily. Only copies obtained between 20:02 UTC on 15 October and 07:12 UTC on 16 October 2026 are affected. Check when the plugin was installed or updated.
Your next step: open your hosting file manager, check the date the rank-math-pro folder last changed, and if it falls inside the window, start with the backup restore.
3 comments