Rank Math Pro Malware: 3.0.123 Compromise and What to Do

Rank Math PRO 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC contained malware, according to Rank Math's own incident notice. This Rank Math Pro malware case is tracked as CVE-2026-111862. If your site installed and activated 3.0.123 in that window, Rank Math says to treat it as compromised.

The fix is version 3.0.124, but installing it isn't the whole job. Rank Math warns that the malware "can recreate its hidden backdoor whenever someone visits the website," so a site that ran the bad code may still be open after the update. This is a case where updating the plugin comes first and cleaning the site comes second.

What happened

Rank Math says it found a security issue affecting "a limited number of users" who downloaded PRO 3.0.123 in an 11-hour window. It removed the affected files and released a clean 3.0.124. The company hasn't published a count of affected sites in the notice we read.

This is a supply-chain attack. The code arrived through the vendor's own download channel, not through a bug an attacker used against your site. Patchstack says exactly that: the case involves the Rank Math SEO PRO infrastructure, so a firewall rule isn't possible for it. Patchstack scores it CVSS 9.8, and so does our database, which mirrors the Wordfence feed.

Key finding

Only a subset of 3.0.123 packages carried the malware, but a site that activated one should be treated as compromised. Updating to 3.0.124 doesn't remove a backdoor that already ran.

Rank Math's notice doesn't say how the malicious files got into distribution. We don't know, so we won't guess.

Am I affected?

Start with the version. In WordPress, open Plugins and read the Rank Math PRO version. Then work out when you got it. Rank Math splits the cases three ways:

Agencies should check every client site, including ones on auto-update. Look at your update logs, your management dashboard history and the modified times on the rank-math-pro folder. We're reading that last point as general practice, not a Rank Math instruction.

Rank Math also says some customers got an email from it. It adds that it will never send login or download links by email, so treat any message pushing a password-reset or download link as suspect. Get the plugin only from your account at rankmath.com.

The free Rank Math plugin from the WordPress directory is a separate product. The notice we read concerns PRO only and doesn't name the free plugin.

What to do now

If you activated 3.0.123 in the window, here's the order Rank Math gives. The order matters.

1. Restore if you can. Rank Math's preferred option is a backup from before October 15, 20:02 UTC (16:02 EDT, or 01:32 IST on October 16). Restore files and database, scan, change every credential, then install 3.0.124.
2. No clean backup? Stop the rebuild first. Delete the whole rank-math-pro folder (deactivating isn't enough). Delete the wp_options rows named _uf6qdn2hmm, t8krdk990phb and _np5pvf754c. Block outgoing connections to rank1cdn.com if your host or firewall allows it.
3. Then hunt for what it left. Check wp-content/mu-plugins/, other plugins' folders, the inc/, includes/ and lib/ folders of non-default themes, and the Rank Math includes/ folder for hidden PHP. Rank Math lists these code patterns: base64_decode with XOR loops, the key xmmqhn, proc_open, and PHP-FPM socket code.
4. Check accounts and files. Run wp user list --role=administrator. Look for admins named wpsupport_ plus random characters, or emails ending in @wp-mail[.]net. Look for wp-includes/class-wp-cache-util.php, which isn't a real core file, and run wp core verify-checksums.
5. Check server-level persistence. Look for .htaccess rules that let .cache files run as PHP, .cache files that contain PHP, crontab entries tagged #ms6v46, and odd events in wp cron event list. Rank Math also says to review SSH authorized_keys, other users' crontabs and running processes.
6. Rotate everything. Rank Math calls this essential even after a restore: WordPress passwords, database credentials, the keys and salts in wp-config.php, payment, SMTP and API keys, and hosting, FTP and SSH access. Review 2FA for admins.
7. Install 3.0.124 and verify. Download it from your Rank Math account. Run a scan, wp core verify-checksums and wp plugin verify-checksums --all, then watch outgoing connections and see whether removed files come back. Checksums often aren't available for premium plugins, so compare against a clean vendor copy.

Some users may need to reset their Rank Math account password to log in. If you're not comfortable editing databases or server files, Rank Math itself recommends asking your host or a security professional.

Our guides on PHP backdoors in WordPress, the signs a site is hacked and the full malware removal process cover where this kind of code hides and how to clear it.

The indicators above come from Rank Math's notice. Checking for them is the right start, but a clean result isn't proof of a clean site. Attackers change things, and the notice doesn't claim to be a complete list.

Why "keep plugins updated" didn't help here

The usual advice is to install updates fast. This time the update was the delivery route. Sites on auto-update could pick up the bad package without anyone clicking anything, which is why the exposure window matters more than the version number alone.

It also means a vulnerability scanner that only compares version numbers has little to work with. 3.0.123 is the vulnerable version, but running it doesn't prove infection, and moving to 3.0.124 doesn't prove you're clean. You have to look at what's on the server.

We wrote about this class of risk in how to verify a WordPress plugin update. For other updates worth doing this week, see the plugins to patch this week.

Let us check it

A surface scan is free and shows whether your Rank Math PRO version is on our vulnerability list. The $1 deep scan goes inside the server over SSH and checks files, users, cron jobs and the database, which is where persistence from an incident like this lives. If it finds something, our $49 cleanup removes it, and the first cleanup is free for new users.

References

• Rank Math: PRO 3.0.123 Security Incident, How to Secure Your Website
• Patchstack: Rank Math SEO PRO 3.0.123 Backdoor (CVE-2026-111862)
• Wordfence Intelligence: Rank Math SEO PRO 3.0.123 Unauthenticated Embedded Malicious Code
• CVE-2026-111862 in the WP Vanguard vulnerability database