---
title: "Rank Math Pro Malware: 3.0.123 Compromise and What to Do"
slug: "rank-math-pro-malware-supply-chain-compromise"
description: "Rank Math Pro malware hit 3.0.123 downloads on Oct 15-16. Updating to 3.0.124 may not clean the site. Here is how to check and recover."
date: 2026-10-18
author: "WP Vanguard Team"
category: "News"
palette: "edu"
tags: ["rank-math-pro-malware", "cve-2026-111862", "rank-math-pro", "supply-chain-attack", "wordpress-backdoor"]
featured_image: "/images/blog/rank-math-pro-malware-supply-chain-compromise.jpg"
---

Rank Math PRO 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC contained malware, according to Rank Math's own incident notice. This Rank Math Pro malware case is tracked as CVE-2026-111862. If your site installed and activated 3.0.123 in that window, Rank Math says to treat it as compromised.

The fix is version 3.0.124, but installing it isn't the whole job. Rank Math warns that the malware "can recreate its hidden backdoor whenever someone visits the website," so a site that ran the bad code may still be open after the update. This is a case where updating the plugin comes first and cleaning the site comes second.

## What happened

Rank Math says it found a security issue affecting "a limited number of users" who downloaded PRO 3.0.123 in an 11-hour window. It removed the affected files and released a clean 3.0.124. The company hasn't published a count of affected sites in the notice we read.

This is a supply-chain attack. The code arrived through the vendor's own download channel, not through a bug an attacker used against your site. Patchstack says exactly that: the case involves the Rank Math SEO PRO infrastructure, so a firewall rule isn't possible for it. Patchstack scores it CVSS 9.8, and so does our database, which mirrors the Wordfence feed.

```timeline
{"title": "Rank Math PRO 3.0.123", "highlight": 3, "data": [
  {"label": "Oct 15", "sub": "20:02 UTC", "text": "Affected download window opens"},
  {"label": "Oct 16", "sub": "07:12 UTC", "text": "Window closes"},
  {"label": "Oct 16", "sub": "Rank Math", "text": "Incident notice published"},
  {"label": "3.0.124", "sub": "Clean version", "text": "Install, then clean up"}
]}
```

> [!KEY]
> Only a subset of 3.0.123 packages carried the malware, but a site that activated one should be treated as compromised. Updating to 3.0.124 doesn't remove a backdoor that already ran.

Rank Math's notice doesn't say how the malicious files got into distribution. We don't know, so we won't guess.

## Am I affected?

Start with the version. In WordPress, open Plugins and read the Rank Math PRO version. Then work out when you got it. Rank Math splits the cases three ways:

| What you did | Rank Math's guidance |
|---|---|
| Installed and activated 3.0.123 in the window | Treat the site as compromised and run the recovery steps |
| Installed but never activated it | Delete the files, install 3.0.124, run a security scan |
| Downloaded the zip but never installed it | No sign of compromise from this alone |

Agencies should check every client site, including ones on auto-update. Look at your update logs, your management dashboard history and the modified times on the `rank-math-pro` folder. We're reading that last point as general practice, not a Rank Math instruction.

Rank Math also says some customers got an email from it. It adds that it will never send login or download links by email, so treat any message pushing a password-reset or download link as suspect. Get the plugin only from your account at rankmath.com.

The free Rank Math plugin from the WordPress directory is a separate product. The notice we read concerns PRO only and doesn't name the free plugin.

## What to do now

If you activated 3.0.123 in the window, here's the order Rank Math gives. The order matters.

1. **Restore if you can.** Rank Math's preferred option is a backup from before October 15, 20:02 UTC (16:02 EDT, or 01:32 IST on October 16). Restore files and database, scan, change every credential, then install 3.0.124.
2. **No clean backup? Stop the rebuild first.** Delete the whole `rank-math-pro` folder (deactivating isn't enough). Delete the `wp_options` rows named `_uf6qdn2hmm`, `t8krdk990phb` and `_np5pvf754c`. Block outgoing connections to `rank1cdn.com` if your host or firewall allows it.
3. **Then hunt for what it left.** Check `wp-content/mu-plugins/`, other plugins' folders, the `inc/`, `includes/` and `lib/` folders of non-default themes, and the Rank Math `includes/` folder for hidden PHP. Rank Math lists these code patterns: `base64_decode` with XOR loops, the key `xmmqhn`, `proc_open`, and PHP-FPM socket code.
4. **Check accounts and files.** Run `wp user list --role=administrator`. Look for admins named `wpsupport_` plus random characters, or emails ending in `@wp-mail[.]net`. Look for `wp-includes/class-wp-cache-util.php`, which isn't a real core file, and run `wp core verify-checksums`.
5. **Check server-level persistence.** Look for `.htaccess` rules that let `.cache` files run as PHP, `.cache` files that contain PHP, crontab entries tagged `#ms6v46`, and odd events in `wp cron event list`. Rank Math also says to review SSH `authorized_keys`, other users' crontabs and running processes.
6. **Rotate everything.** Rank Math calls this essential even after a restore: WordPress passwords, database credentials, the keys and salts in `wp-config.php`, payment, SMTP and API keys, and hosting, FTP and SSH access. Review 2FA for admins.
7. **Install 3.0.124 and verify.** Download it from your Rank Math account. Run a scan, `wp core verify-checksums` and `wp plugin verify-checksums --all`, then watch outgoing connections and see whether removed files come back. Checksums often aren't available for premium plugins, so compare against a clean vendor copy.

Some users may need to reset their Rank Math account password to log in. If you're not comfortable editing databases or server files, Rank Math itself recommends asking your host or a security professional.

Our guides on [PHP backdoors in WordPress](/blog/php-backdoors-in-wordpress), the [signs a site is hacked](/blog/signs-wordpress-site-hacked) and the full [malware removal process](/blog/wordpress-malware-removal-guide) cover where this kind of code hides and how to clear it.

The indicators above come from Rank Math's notice. Checking for them is the right start, but a clean result isn't proof of a clean site. Attackers change things, and the notice doesn't claim to be a complete list.

## Why "keep plugins updated" didn't help here

The usual advice is to install updates fast. This time the update was the delivery route. Sites on auto-update could pick up the bad package without anyone clicking anything, which is why the exposure window matters more than the version number alone.

It also means a vulnerability scanner that only compares version numbers has little to work with. 3.0.123 is the vulnerable version, but running it doesn't prove infection, and moving to 3.0.124 doesn't prove you're clean. You have to look at what's on the server.

We wrote about this class of risk in [how to verify a WordPress plugin update](/blog/verify-wordpress-plugin-update-supply-chain). For other updates worth doing this week, see [the plugins to patch this week](/blog/wordpress-plugins-to-patch-this-week).

## Let us check it

A surface scan is free and shows whether your Rank Math PRO version is on our vulnerability list. The [$1 deep scan](https://wpvanguard.com/pricing) goes inside the server over SSH and checks files, users, cron jobs and the database, which is where persistence from an incident like this lives. If it finds something, our [$49 cleanup](https://wpvanguard.com/pricing) removes it, and the first cleanup is free for new users.

## References

- [Rank Math: PRO 3.0.123 Security Incident, How to Secure Your Website](https://rankmath.com/kb/pro-3-0-123-security-incident/)
- [Patchstack: Rank Math SEO PRO 3.0.123 Backdoor (CVE-2026-111862)](https://patchstack.com/database/wordpress/plugin/seo-by-rank-math-pro/vulnerability/wordpress-rank-math-seo-pro-plugin-3-0-123-unauthenticated-embedded-malicious-code-vulnerability)
- [Wordfence Intelligence: Rank Math SEO PRO 3.0.123 Unauthenticated Embedded Malicious Code](https://www.wordfence.com/threat-intel/vulnerabilities/id/81cd7a2c-ad0c-4dbc-b5dc-07ec866d5c1f)
- [CVE-2026-111862 in the WP Vanguard vulnerability database](https://wpvanguard.com/vulnerabilities/plugin/seo-by-rank-math-pro)