PikaSEO Logo
Security alert
October 18, 2026

Rank Math PRO 3.0.123 Shipped Malware: How to Check and Clean Your Site

Rank Math PRO 3.0.123 malware was distributed for about 11 hours this week: some copies of the paid WordPress SEO plugin, downloaded between October 15 and 16, 2026, carried a self-rebuilding backdoor. Rank Math says any site that activated one should be treated as compromised.

The official Rank Math security notice confirms the incident. Wordfence and Patchstack track it as CVE-2026-111862 with a critical 9.8 CVSS score. Below: who is affected, the indicators to search for, the cleanup order that matters, and the SEO checks most security guides skip.

10 min read Published October 18, 2026

Key takeaways

  • The affected window is October 15, 20:02 UTC to October 16, 07:12 UTC. Only PRO 3.0.123 copies obtained then are named.
  • Updating to 3.0.124 does not clean an infected site. Restore a pre-incident backup or follow the manual cleanup in order.
  • Rotate every password, key and salt the site could read, even after restoring a backup.
  • The free Rank Math plugin on WordPress.org is not named in the advisory.

What happened

On October 16, Rank Math published a notice titled “Rank Math PRO 3.0.123 Security Incident: How to Secure Your Website.” It reads: “We recently identified a security issue affecting a limited number of users who downloaded Rank Math PRO v3.0.123 between October 15, 2026, at 20:02 UTC and October 16, 2026, at 07:12 UTC. The affected plugin files contained malware that could compromise your website if the plugin was activated.” The company says it removed the files and released a clean Rank Math PRO 3.0.124.

International Cyber Digest put it bluntly on X on October 17: “Rank Math shipped malware in its paid WordPress SEO plugin.” That is accurate, but the scope is narrow. The advisory covers one PRO version during one 11-hour-10-minute window. Rank Math's free plugin has more than 4 million active installs on WordPress.org, but neither Rank Math nor the security vendors name it in the incident. PRO install numbers are not public.

This was a supply-chain compromise: the malware came through the vendor's own download and update channel, not through a flaw an attacker exploited on your site. Patchstack says it “involves a supply chain attack against the Rank Math SEO PRO infrastructure and therefore a rule is not possible for mitigation.” Firewall rules cannot block code you installed yourself.

Wordfence's summary describes what the payload could do: it “may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server.”

Timeline of the Rank Math security incident

  1. Oct 7

    Rank Math's changelog lists the legitimate PRO 3.0.123 release.

  2. Oct 14, 19:31 UTC

    rank1cdn.com, the domain Rank Math tells users to block, is registered (public RDAP record).

  3. Oct 15, 20:02 UTC

    The affected download window opens.

  4. Oct 16, 07:12 UTC

    The window closes. Rank Math removes the files and ships PRO 3.0.124.

  5. Oct 16, 20:32 UTC

    Rank Math publishes its security notice.

  6. Oct 17

    Wordfence and Patchstack publish advisories rated CVSS 9.8, and the news spreads on X.

Two details stand out. First, the changelog dates the real 3.0.123 to October 7, eight days before the bad window. That suggests tainted files replaced a legitimate package under the same version number, though Rank Math has not explained how. Second, the domain Rank Math tells users to block was registered about a day before the window opened. Both patterns resemble the ShapedPlugin Pro compromise in June 2026, where a clean version was swapped for a tampered one, and the Gravity Forms incident in July 2025, which used a lookalike domain registered days before the attack.

Is your site affected?

Running 3.0.123 does not by itself mean a site is infected. Wordfence stresses that “version 3.0.123 by itself does not prove that a website was compromised.” The question is when you got it and whether it ran. According to Wordfence, Rank Math has records of who downloaded an affected copy, and the notice refers to emails sent to those users, so check your inbox, including spam. It also warns it “will never send login or download links by email,” so treat any such email as phishing.

Installed and activated in the window

Treat the site as compromised. Follow the full recovery below.

Installed, never activated

Delete the plugin files, install 3.0.124 from your Rank Math account, and run a security scan.

Downloaded, never installed

Rank Math sees no sign of compromise from this alone. Delete the zip.

Agencies should check every client site with Rank Math PRO on auto-update, not just sites updated by hand. An automatic update during the window counts. Check plugin update logs, your management dashboard history, and file modification times on the rank-math-pro folder.

Rank Math backdoor indicators of compromise

These are the indicators listed in the Rank Math notice. The named database rows, domain, usernames, fake core file and cron tag are specific to this incident; finding any of them means you should treat the site as compromised, even if it now runs 3.0.124. The code patterns are broader and can appear in legitimate plugins, so investigate those matches before deleting anything.

WhereWhat to look for
Databasewp_options rows named _uf6qdn2hmm, t8krdk990phb or _np5pvf754c
NetworkOutgoing connections to rank1cdn.com
UsersAdministrators named wpsupport_ plus random characters, or emails ending in @wp-mail[.]net
Core filesA fake wp-includes/class-wp-cache-util.php (not a real WordPress file)
Server config.htaccess rules letting .cache files run as PHP, and .cache files that contain PHP
CronSystem crontab entries tagged #ms6v46, plus unexpected WordPress cron events
Code patternsbase64_decode with XOR loops, the key xmmqhn, proc_open, or PHP-FPM socket code

Rank Math also says to check wp-content/mu-plugins/, other plugins' folders, the inc/, includes/ and lib/ folders of non-default themes, and the Rank Math includes/ folder for hidden PHP. On the server, review SSH authorized_keys, other users' crontabs, running processes, and any writable location outside the site. If you are on shared hosting, ask your host to check these.

How to clean up an affected site

Recommended: restore from a clean backup. Use a backup made before October 15 at 20:02 UTC (22:02 CEST, 16:02 EDT, or 01:32 IST on October 16). Restore both files and the database, run a scan with a tool such as Wordfence or Sucuri, rotate credentials, and then install 3.0.124. A backup taken after the window may contain the backdoor.

If you have no clean backup, clean it manually, in this order. The notice warns: “The malware can recreate its hidden backdoor whenever someone visits the website.” If you delete files before disabling the rebuild, they can come back.

  1. Stop the rebuild. Delete the entire rank-math-pro folder (Rank Math says deactivating it is not enough). Delete the three malicious wp_options rows listed above. Block outgoing connections to rank1cdn.com at your firewall or host if you can.
  2. Remove what it left behind. Hunt down the backdoor files, rogue administrators (wp user list --role=administrator), the fake core file, .htaccess and .cache changes, malicious cron jobs (wp cron event list), and any PHP files in uploads/. Reinstall other plugins and themes from official sources.
  3. Rotate every credential (full list in the next section).
  4. Verify. Run wp core verify-checksums and wp plugin verify-checksums --all, scan again, and watch outbound connections and file changes for several days. Checksums are often unavailable for premium plugins, so compare those with clean copies from the vendor.
  5. Reinstall Rank Math PRO 3.0.124 from your rankmath.com account. Rank Math says some customers may need to reset their account password to log in.

If you are not comfortable editing databases or server files, hand this to your host or a security professional. Rank Math recommends the same. A half-finished cleanup that leaves the rebuild in place is worse than a slower, complete one.

Credentials to rotate, even after a restore

A backup restores files, but it cannot un-leak a secret. Rank Math calls this step “essential, even if you restore your website from a backup.” Assume anything the web server could read has been copied.

  • All WordPress user passwords
  • Database username and password in wp-config.php
  • WordPress security keys and salts
  • Payment gateway keys (Stripe, PayPal, and others)
  • SMTP and transactional email credentials
  • Third-party API keys stored in plugin settings
  • Hosting panel, FTP, SFTP and SSH credentials
  • Secrets in environment variables; review 2FA for admins

SEO teams should include the integrations they usually forget: AI writing API keys, rank tracker and analytics API tokens, and connected Google services. Review third-party access on the Google account linked to the site and remove anything unfamiliar.

Why a compromised SEO plugin is an SEO problem too

Rank Math's notice is about credentials and persistence. It does not say the malware injected spam or redirects, and we have seen no report that it did. But an attacker with an admin account and a backdoor can change what Google sees, and SEO plugins already control titles, canonicals, redirects, sitemaps and schema. Once the security cleanup is done, run these checks:

  1. Search Console security and manual actions. Open the Security issues report and Manual actions. If Google flags hacked content, fix it and request a review there. Google's site abuse documentation covers the process.
  2. Search Console owners. Under Settings, open Users and permissions and remove any owner or verification token you do not recognize. Google's guide explains how; an attacker-added owner can keep access after cleanup.
  3. Indexed pages. Search site:yourdomain.com with spam terms such as casino, pharma or loan names, and check the Pages report for a sudden rise in indexed URLs. Validate your sitemaps with the Sitemap Validator and confirm robots.txt is unchanged with the Robots.txt Checker.
  4. Redirects and outbound links. Malware often redirects visitors from search but not logged-in admins. Test key URLs with the Redirect Checker, scan for injected links with the External Link Checker, and review Rank Math's own Redirections module for rules you did not add.
  5. A full technical baseline. Run a Technical SEO Audit and an HTTP Header Checker pass on your top templates, then compare titles, canonicals and status codes with your last known-good crawl.

Keep a dated note of the incident in your analytics and reporting. If rankings or traffic move in late October, you will want to separate a security cleanup from an algorithm change.

What we still do not know

As of October 18, Rank Math has not disclosed how the malicious build got into distribution, how many customers downloaded it, or who was behind it. The notice says only that the team “is taking steps to reduce the risk of similar incidents in the future.” The forced account password resets hint that customer accounts were part of the response, but Rank Math has not said whether its account or license systems were breached.

Reports also disagree on exploitation. One security news site labeled the incident “exploited in the wild,” but the only basis given was that the malware shipped. We have seen no public telemetry showing attacker activity on infected sites. The CVE ID appears in the Wordfence and Patchstack databases, but the public CVE record had not been published at the time of writing.

Trust in Rank Math was already under strain. In August, Search Engine Journal reported allegations that the free plugin's AI Support Agent created an admin Application Password without clearly asking, and Rank Math paused the feature. That was a separate issue, not malware. Still, two security-related stories in two months will push many agencies to ask how their SEO plugin vendors sign builds and secure update servers. After the OptinMonster CDN compromise and the ShapedPlugin breach earlier this year, that is a fair question for every premium plugin.

Frequently asked questions

Sources

About the Author

Ayush Chaturvedi
Ayush Chaturvedi

Co-Founder & SEO Execution

Co-founder of PikaSEO. 11 years in corporate tech, then bootstrapped entrepreneur. Leads SEO execution and content-led growth for SaaS companies.

LinkedInX (Twitter)
Read more SEO research and news.