Rank Math PRO 3.0.123 downloads shipped with a backdoor

On 16 October 2026 Rank Math disclosed that some copies of Rank Math PRO 3.0.123, the paid edition of its SEO plugin, contained malware. The affected copies are those downloaded, directly or through an update, between 20:02 UTC on 15 October and 07:12 UTC on 16 October. Rank Math removed the infected files and released a clean version, 3.0.124. On 17 October Patchstack and Wordfence listed the incident as CVE-2026-111862, with a CVSS score of 9.8 ("critical").

The update arrived through the usual channel and looked like any other. Inside it was a backdoor, a hidden way in that lets an attacker into the site whenever they like.

What the malicious code does

According to Rank Math, the code can compromise the site if the plugin was activated, and recreate the backdoor every time someone visits. The attacker may also have left other files, administrator accounts and scheduled tasks behind. Rank Math advises assuming that the passwords, keys and other secrets the site can reach have been exposed.

Version 3.0.124 replaces the plugin's files and nothing else, so whatever the code has already created elsewhere on the site stays. Its changelog entry repeats that of 3.0.123 and does not mention the incident. Rank Math does not explain how the code got into the files, and Patchstack notes that a firewall rule (a virtual patch) cannot protect against it.

Is your site affected?

Running 3.0.123 does not by itself mean the site is infected. According to Rank Math, what matters is when the copy was downloaded and what you did with it.

• If you installed and activated 3.0.123 during that window, treat the site as hacked.
• If you installed it but never activated it, delete its files, install 3.0.124 from your Rank Math account and scan the site.
• If you only downloaded the archive and never installed it, Rank Math says there is no sign the site was affected.

If Rank Math has emailed you about the incident, follow its instructions even if the site has since moved to another version. The notice covers PRO only and does not mention the free Rank Math SEO plugin from wordpress.org (4 million active installations), whose latest version, 1.0.280, dates from 6 October, before the window.

You can see the PRO version under Plugins > Installed Plugins. In cPanel's Terminal, the command below lists the Rank Math plugins. The WP-CLI guide explains how to work with WP-CLI.

# cPanel > Terminal, in the site's folder
# Read-only. Lists the Rank Math plugins and their versions.
wp plugin list --fields=name,title,status,version \
  --skip-plugins --skip-themes | grep -i rank

With --skip-plugins --skip-themes WP-CLI skips the plugins and the theme, so the check does not run the infected code (must-use plugins still load). The free plugin is the line seo-by-rank-math.

How to look for signs of the attack

The commands below look for some of the traces Rank Math lists. They change nothing.

# cPanel > Terminal, in the site's folder
# Read-only. Looks for the traces Rank Math describes.
for k in _uf6qdn2hmm t8krdk990phb _np5pvf754c; do
  wp option list --search="$k" --field=option_name \
    --skip-plugins --skip-themes
done
wp user list --role=administrator \
  --fields=ID,user_login,user_email,user_registered \
  --skip-plugins --skip-themes
ls -l wp-includes/class-wp-cache-util.php
wp cron event list --skip-plugins --skip-themes
crontab -l | grep ms6v46

Any name the loop at the top prints is an entry the malware left in wp_options. In the list of administrators, look for unfamiliar usernames starting with wpsupport_ and email addresses ending in @wp-mail.net. The file class-wp-cache-util.php is not part of WordPress, so on a clean site ls answers "No such file or directory". The last two list WordPress's scheduled events, where you look for unfamiliar names, and search the cPanel account's cron jobs for the marker #ms6v46, which prints nothing on a clean site.

Rank Math also names traces that are hard to find by hand, such as PHP files in mu-plugins and uploads, .cache files containing PHP code and connections from the server to rank1cdn.com. Finding nothing does not prove the site is clean.

What to do

1. If an infected copy was active on the site, an update alone will not do. Rank Math recommends restoring the files and the database from a backup made before 20:02 UTC on 15 October. The backup guide shows how.
2. Without such a backup the site is cleaned by hand, and the order matters. First delete the whole Rank Math PRO folder (deactivating it is not enough) and the three wp_options entries, then block connections to rank1cdn.com if your hosting allows it. Only after that remove the other traces, or the backdoor can come back.
3. Change passwords and keys even after restoring from a backup, from the administrators and the database to the salts in wp-config.php, the payment and SMTP keys and your cPanel, FTP and SSH access.
4. Finally, install 3.0.124 from your account on rankmath.com. A site on 3.0.123 that was updated outside the window should move to it as well.

What we do

With vulnerability (CVE) monitoring we match the plugins, theme and WordPress on your site against the vulnerability (CVE) databases every day. As soon as a vulnerability appears in something you use, we send you an alert, and we try the update on a copy in staging first. If the checks above show signs of the attack, with hacked site cleanup we remove the malware and the backdoors. We do both for your site wherever it is hosted.

Sources

• Rank Math, Rank Math PRO 3.0.123 Security Incident
• Rank Math, PRO Changelog
• Patchstack, Rank Math SEO PRO 3.0.123 Backdoor
• Wordfence, PSA Malware Found in Some Rank Math SEO PRO 3.0.123 Downloads
• Wordfence, Rank Math SEO PRO 3.0.123 Unauthenticated Embedded Malicious Code
• WordPress.org, Rank Math SEO
• WP-CLI, wp plugin list
• WP-CLI, wp option list
• WP-CLI, wp user list
• WP-CLI, wp cron event list