If you run a WordPress site with Rank Math PRO, stop and check this: for about 11 hours last week, downloads of the plugin from Rank Math’s own website carried malware that plants a hidden backdoor on your site. The free version is safe. The fix isn’t just updating — here’s how to check whether you were exposed and what to do about it.
What happened
Rank Math confirmed that some downloads of Rank Math PRO version 3.0.123 from its official website contained malware. When the compromised plugin was activated, it established persistent access to the site, communicated with a command-and-control domain (rank1cdn[.]com), and could recreate hidden backdoors whenever someone visited the infected website. According to the vendor, installing the compromised version could also expose database credentials, API keys, and other secrets accessible to the web server.
Rank Math disclosed the incident on October 16 and released a clean version, Rank Math PRO 3.0.124. The compromise is tracked as CVE-2026-111862 with a CVSS severity of 9.8 out of 10 — critical. Rank Math describes the number of affected users as “limited,” but has not disclosed an exact count. The company does have records of which customers downloaded the tainted build, so affected customers should expect to be contacted directly — and should be wary of fake “recovery” emails: Rank Math says it never sends login or download links by email.
Were you exposed? The window, in US time
Exposure depends on when you downloaded or updated — not just which version you have installed. Rank Math published the window in UTC only. Converted for US readers:
| Event | Eastern | Pacific | IST |
|---|---|---|---|
| Compromised downloads begin | Thu Oct 15, 4:02 PM | Thu Oct 15, 1:02 PM | Fri Oct 16, 1:32 AM |
| Compromised downloads end | Fri Oct 16, 3:12 AM | Fri Oct 16, 12:12 AM | Fri Oct 16, 12:42 PM |
Our conversion of the vendor’s published UTC window (Oct 15, 20:02 UTC to Oct 16, 07:12 UTC). Only packages downloaded within the vendor-confirmed window are considered affected — the version number alone doesn’t prove compromise. If your copy of Rank Math PRO 3.0.123 arrived inside the window and the plugin was activated, Rank Math says to treat your site as compromised.
Self-check: 7 things to look for
Based on the indicators in the vendor advisory, check your site for:
- Your download history. Did Rank Math PRO 3.0.123 arrive during the window above?
- Suspicious admin accounts. Look for administrator accounts you didn’t create — usernames starting with
wpsupport_, or accounts with email addresses ending in@wp-mail.net. - Three rogue database entries. Search your
wp_optionstable for_uf6qdn2hmm,t8krdk990phb, and_np5pvf754c. Finding any one of them means the malware ran on your site. - A planted cron marker. Check scheduled tasks for
#ms6v46. - Fake and altered files. Look for
wp-includes/class-wp-cache-util.php(not a real WordPress file), PHP code hidden in.cachefiles,.htaccessrules that execute.cachefiles as PHP, and PHP files inuploads,mu-plugins, or theme folders where they don’t belong. - Outbound connections. Check firewall and server logs for traffic to
rank1cdn[.]com. - Server-level traces. Review SSH
authorized_keys, other system users’ crontabs, and running processes for anything you don’t recognize — the malware can persist outside WordPress itself.
If you were exposed: cleanup steps
Rank Math’s guidance is blunt on one point — deactivating or updating the plugin after a compromise does not remove the threat. Follow the vendor’s cleanup procedure:
- Restore your website files and database from a clean backup made before the exposure window.
- Run full security scans.
- Rotate all passwords, API keys, database credentials, hosting/FTP/SSH logins, and WordPress salts.
- Block all outbound connections to
rank1cdn[.]com. - If you have no safe backup: delete the entire
rank-math-proplugin folder, remove all three maliciouswp_optionsentries, then hunt for the remaining traces from the self-check list above — fake core files,.htaccessrules, modified plugins and themes, unauthorized admin accounts, SSH keys, and other users’ scheduled tasks. - Finish with a core integrity check (
wp core verify-checksums) and a clean reinstall of WordPress core files.
If you never activated it
Downloaded 3.0.123 but never activated the plugin? The vendor’s advice is simpler: delete it, download the clean 3.0.124 release, and run a security scan to be safe.
Free version users: you’re fine
Only the paid PRO plugin sold through Rank Math’s website was compromised. The free Rank Math SEO plugin distributed via WordPress.org — active on more than 4 million websites — was not affected. This site runs the free version, and we verified our install against the advisory.
Sources: Rank Math security advisory, BleepingComputer, SecurityWeek, Wordfence.
