Rank Math PRO shipped a backdoor through its own updates. Check when your copy arrived before you trust the fix

Rank Math PRO is the paid edition of one of the most common SEO plugins on WordPress. For about eleven hours last week, copies of it downloaded from rankmath.com or pushed as updates carried malware.

Rank Math says any site that installed and activated one of those copies should be treated as compromised, even if it has since moved to the clean 3.0.124. Updating the plugin does not remove what the malware left behind.

If Rank Math PRO updated on your site between 4:02 PM ET on October 15 and 3:12 AM ET on October 16, the clean update does not clean the site.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Rank Math’s own download channel served a backdoored PRO build

Rank Math says that a limited number of users who downloaded Rank Math PRO 3.0.123 between 20:02 UTC on October 15 and 07:12 UTC on October 16 received plugin files containing malware. It removed the files and released a clean version, 3.0.124.

Wordfence assigned the incident CVE-2026-111862 and rated it 9.8. The CVE record says the version number alone does not prove compromise: 3.0.123 itself dates to October 7, and only packages obtained during the window are affected.

The free Rank Math SEO plugin on WordPress.org, which has more than 4 million active installations, is not affected, according to Rank Math.

Sites that activated a copy from the 11-hour window are compromised

According to Rank Math, the malware sets up persistent access, talks to rank1cdn[.]com and recreates a hidden backdoor whenever someone visits the site. It can also expose database credentials, API keys and any other secret the web server can read.

The indicators Rank Math lists go well past the plugin folder: PHP files in mu-plugins, other plugins and themes, a fake core file at wp-includes/class-wp-cache-util.php, administrator accounts starting with wpsupport_, .htaccess rules that run .cache files as PHP, and a crontab entry tagged #ms6v46. Rank Math has not said how its update system was breached or how many sites received a bad copy.

Find out when your PRO copy arrived, then restore or clean up

• Check when Rank Math PRO was last installed or updated on each site you run. Rank Math sorts sites three ways: activated during the window (compromised), installed but never activated (delete the files, install 3.0.124, scan), or downloaded only (no action from this incident).
• For an affected site, restore files and database from a backup taken before 20:02 UTC on October 15, scan it, change every password and key, and only then install 3.0.124 from your Rank Math account.
• With no clean backup, follow Rank Math’s order: delete the whole rank-math-pro folder (deactivating is not enough), delete the _uf6qdn2hmm, t8krdk990phb and _np5pvf754c rows in wp_options, and block outbound traffic to rank1cdn[.]com. Then hunt for the other changes.
• Rotate the database password and the keys and salts in wp-config.php, plus payment, SMTP, hosting, SFTP and SSH credentials, even after a restore.

Details

• CVE-2026-111862: embedded malicious code (CWE-506) in a subset of Rank Math SEO PRO 3.0.123 packages, CVSS 3.1 score 9.8.
• Window: October 15, 2026 20:02 UTC to October 16, 2026 07:12 UTC (4:02 PM to 3:12 AM ET). Clean release: 3.0.124.
• Indicators (Rank Math): wp_options keys _uf6qdn2hmm, t8krdk990phb, _np5pvf754c; domain rank1cdn[.]com; wp-includes/class-wp-cache-util.php; admin users wpsupport_* or @wp-mail[.]net emails; crontab marker #ms6v46; XOR key xmmqhn.
• Not affected: the free Rank Math SEO plugin from WordPress.org.

Hunt / verify

• Run wp user list --role=administrator and look for wpsupport_ logins or @wp-mail[.]net addresses.
• Look for wp-includes/class-wp-cache-util.php and run wp core verify-checksums; checksums are not published for the PRO plugin itself.
• Check the web server user’s crontab for #ms6v46, WordPress scheduled events, SSH authorized_keys files and DNS or proxy logs for rank1cdn[.]com.

Source: Rank Math security notice; CVE.org: CVE-2026-111862

Sources

• Rank Math: PRO 3.0.123 Security Incident, How to Secure Your Website
• CVE.org: CVE-2026-111862
• Wordfence: Malware Found in Some Rank Math SEO PRO 3.0.123 Downloads
• BleepingComputer: WordPress SEO plugin Rank Math compromised to backdoor websites
• The Hacker News: Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].