Rank Math, the company behind one of the most widely installed SEO plugins for WordPress, confirmed on October 16, 2026, that some copies of its paid edition, Rank Math PRO 3.0.123, contained malware. The tainted files came from its own website and reached anyone who downloaded or updated the plugin between 8:02 p.m. UTC on October 15 and 7:12 a.m. UTC on October 16 (4:02 p.m. to 3:12 a.m. ET).
According to the company’s security notice, the code could compromise a site if the plugin was activated. Rank Math says it removed the affected files and released a clean version, 3.0.124. It asks owners to treat any site that activated a tainted copy as compromised, even after updating. The free edition, distributed through WordPress.org and active on more than 4 million sites according to its listing, is not affected.
Eleven hours of tainted downloads
Rank Math’s changelog dates version 3.0.123 to October 7, 2026. The window in which tainted files went out opened eight days later, on the evening of October 15, and closed the next morning, a little over 11 hours in all. Version 3.0.124 shipped on October 16. Its changelog entry repeats word for word the two fixes listed for 3.0.123 (a stuck CSV import and incomplete AI Link Genius exports) and says nothing about the incident.
The security notice, titled “Rank Math PRO 3.0.123 Security Incident: How to Secure Your Website,” went up at 8:32 p.m. UTC on October 16 and was updated on October 19. It refers to “a limited number of users” without giving a figure. WPScan opened an entry on October 16 under the title “Rank Math SEO PRO 3.0.123 - Backdoor via Supply Chain Compromise.” On October 19, Wordfence, which assigns CVE IDs for WordPress plugins and themes, published CVE-2026-111862 with a score of 9.8 out of 10, in the critical range.
The notice covers the PRO edition only. It doesn’t mention Instant Indexing for Google, another free Rank Math plugin we looked at in our story on the rewrite of Google’s Indexing API documentation. BleepingComputer and SecurityWeek covered the incident on October 19, three days after the notice.
A backdoor that can rebuild itself on every visit
Rank Math describes code built to persist. It can talk to the domain rank1cdn[.]com, which the company recommends blocking for outbound traffic, and recreate its hidden backdoor every time a visitor loads a page. That’s why Rank Math sets a specific order for manual cleanup: delete the entire rank-math-pro folder and the malicious database entry first, and only then look for everything else. Deactivating the plugin isn’t enough, the notice says.
The company lists many indicators of compromise. They include three entries in the wp_options table (_uf6qdn2hmm, t8krdk990phb and _np5pvf754c), administrator accounts whose usernames start with wpsupport_ or whose email addresses end in @wp-mail[.]net, and a fake WordPress file, wp-includes/class-wp-cache-util.php, that isn’t part of the official distribution. The notice also flags rules added to the .htaccess file that make files with a .cache extension run as PHP, and scheduled tasks tagged #ms6v46 in the server’s crontab.
The code can also drop files elsewhere: in wp-content/mu-plugins, in other plugins’ folders and in theme folders. Rank Math doesn’t rule out changes outside WordPress, including to the hosting account’s authorized SSH keys.
The broadest risk involves secrets. Rank Math tells owners to assume that every credential and secret the site had access to may have been exposed: WordPress passwords, database credentials, the keys and salts in wp-config.php, payment gateway keys, SMTP credentials, API keys and hosting access.
Three scenarios, according to the vendor
The notice doesn’t lump every site on 3.0.123 together. According to the CVE record, only copies of that version obtained during the 11-hour window are affected.
Rank Math asks owners to treat a site as compromised if the version was installed and activated there during that period. If the plugin was installed but never activated, the company advises deleting the files, installing 3.0.124 and running a scan as a precaution. For a copy that was downloaded but never installed, the notice says the incident alone gives no indication of a compromise.
For compromised sites, Rank Math’s first recommendation is to restore the files and database from a backup made before 8:02 p.m. UTC on October 15, a process covered in our WordPress maintenance guide. Next come a security scan, a reset of every credential and, only then, the installation of 3.0.124. To check files, Rank Math points to the WP-CLI commands wp core verify-checksums and wp plugin verify-checksums --all, with the caveat that checksums may be missing, particularly for premium plugins.
The company makes two more points. Some customers may be unable to log in to their rankmath.com account and may need to reset their password. Rank Math says it never sends login or download links by email and asks users to treat any unsolicited message containing one as suspicious.
A sample found by BleepingComputer
On October 19, Bill Toulas of BleepingComputer reported a PHP file named “cache-preloader-fff033 (1).php” that turned up on VirusTotal. It carries the same indicators as those in Rank Math’s notice: the XOR key xmmqhn, the _np5pvf754c entry, the #ms6v46 marker and code that creates wpsupport_ accounts. According to BleepingComputer, the script appears to act as a first stage that installs the class-wp-cache-util.php backdoor.
The same file can run commands, modify the WordPress database and harvest AWS, Cloudflare, Google Cloud and Azure credentials along with SSH keys. BleepingComputer says it couldn’t confirm the file was distributed through the plugin. The outlet says it asked Rank Math how many sites were affected and how the attackers got in, and had no answer by publication time.
At SecurityWeek, Ionut Arghire relays the company’s warning that the persistence mechanism could make manual cleanup difficult. On Reddit, a thread opened around 10 p.m. UTC on October 19 asked who had been hit; as of 11:10 p.m. UTC, no one had posted any numbers.
The open questions
The number of affected sites is still unknown. Rank Math hasn’t published how many PRO customers it has or how many of them downloaded or updated the plugin during those 11 hours. The notice mentions emails the company sent to some users, without saying who received them or how many were sent.
The attack method hasn’t been explained either. Neither the notice nor the changelog says how malicious files came to be shipped as a version that had been released eight days earlier. One public record sheds light on the timing: according to the Verisign registry, the rank1cdn[.]com domain was registered at 7:31 p.m. UTC on October 14, 2026, about 24 hours before the window opened.
That leaves the question of actual exploitation. The 9.8 score rates the severity of the malicious code; none of the sources reviewed publishes a count of infected sites.
What it means
The attack came through the vendor’s update channel, the one administrators use for routine maintenance. An ordinary plugin vulnerability gets patched in the next release. In this case, 3.0.124 replaces the plugin but leaves behind the accounts, files and scheduled tasks the code created, which is why the instructions are so strict.
The dividing line runs between the free edition, distributed through WordPress.org, and the paid one, served from Rank Math’s own servers. Only the paid edition was hit. Premium plugins are also only partly covered by checksum verification, as the company itself points out.
At risk are PRO-licensed sites that received the update overnight from October 15 to 16. For an agency or a freelancer running several sites on PRO licenses, the question has to be answered site by site.
The potential damage goes beyond search rankings. Payment keys, SMTP access and hosting credentials all fall within the scope Rank Math defined. The published material points to persistent access and possible credential exposure, with no mention of spam pages being injected. The case echoes the OpenCode breach disclosed on October 17, in which a third-party service that held API keys for its customers may have exposed them.
Three things are worth watching: the number of affected sites, which Rank Math hasn’t disclosed; an explanation of the entry point (the company says it is taking steps to reduce the risk of similar incidents, without giving details); and technical analyses from security firms, which should show what the code actually did on compromised sites.
Sources
- Rank Math PRO 3.0.123 Security Incident: How to Secure Your Website, Rank Math, October 16, 2026 (updated October 19, 2026)
- Changelog, Rank Math, October 16, 2026
- CVE-2026-111862: Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code, CVE Program (assigned by Wordfence), October 19, 2026
- Rank Math Pro WordPress Plugin Security Vulnerabilities, WPScan, October 16, 2026
- WordPress SEO plugin Rank Math compromised to backdoor websites, Bill Toulas, BleepingComputer, October 19, 2026
- Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack, Ionut Arghire, SecurityWeek, October 19, 2026
- RDAP record for rank1cdn.com, Verisign, accessed October 20, 2026
- Rank Math SEO, WordPress.org, accessed October 20, 2026
Header image: MACCUS chart, data from Rank Math’s security notice (October 16, 2026) and the CVE-2026-111862 record (October 19, 2026)
