Rank Math disclosed on October 16, 2026, that some Rank Math SEO PRO 3.0.123 downloads contained malware. Any site that activated an affected copy should be treated as compromised, since updating the plugin won’t remove what the malware left behind.
What Happened?
- Rank Math says tainted copies were downloaded or updated between 20:02 UTC on October 15 and 07:12 UTC on October 16.
- Wordfence Intelligence rates the supply-chain compromise 9.8 (Critical) on the CVSS scale and lists version 3.0.124 as the clean release.
- Site owners who activated an affected copy face a full recovery, including a pre-incident backup restore and fresh credentials.
- Rank Math says version 3.0.123 alone does not prove a breach, because only copies obtained inside the stated window are affected.
The malware rebuilds its own backdoor
The malicious files can set up persistent access and communicate with rank1cdn[.]com, according to a Wordfence advisory. They can also recreate hidden backdoors whenever someone loads a page on the site.
That self-repair behavior is why updating falls short. Version 3.0.124 swaps out the Rank Math package, but extra files, rogue admin accounts and scheduled tasks the attacker planted stay where they are. Rank Math says WordPress passwords, database credentials, API keys and other secrets the web server can read may be exposed.
‼️ BREAKING: Rank Math shipped malware in its paid WordPress SEO plugin. Some PRO 3.0.123 copies downloaded on 15 and 16 October carried a backdoor. Rank Math says sites that activated one should treat passwords and API keys as exposed. https://t.co/qEP590DceH
— International Cyber Digest (@IntCyberDigest) October 17, 2026
Rank Math’s security notice flags these signs for investigation:
- wp_options entries named _uf6qdn2hmm, t8krdk990phb or _np5pvf754c
- Unknown administrators with usernames starting wpsupport_ or email addresses ending in @wp-mail[.]net
- A file at wp-includes/class-wp-cache-util.php, which Rank Math says is not a real WordPress core file
- .cache files holding PHP code, plus .htaccess rules that let .cache files run as PHP
- System scheduled tasks for the web server user carrying the marker #ms6v46
Finding none of these doesn’t prove a site is clean, Wordfence cautions.
Cleanup has to happen in a set order
Owners who downloaded 3.0.123 but never installed it have no indication of compromise from this incident alone. Those who installed it without activating it should delete the files, install 3.0.124 from their Rank Math account and run a security scan.
Activated copies need the full treatment. Rank Math recommends restoring the site and database from a backup made before October 15 at 20:02 UTC. Scanning, new credentials and 3.0.124 come next.
Sites without a usable backup must break the reinfection loop first. That means deleting the entire rank-math-pro folder, since deactivation isn’t enough. Owners should also remove the three malicious wp_options rows and block outbound traffic to rank1cdn[.]com where their host or firewall allows it. Only then does hunting for other planted files make sense.
Credential rotation applies even after a clean restore. That covers security keys and salts, payment and email logins, hosting panel access and FTP, SFTP or SSH credentials. Rank Math also advises checking files with wp core verify-checksums and wp plugin verify-checksums –all.
The incident adds to a long run of WordPress plugin vulnerabilities, with one uncomfortable twist. A site that updated promptly during the window could pull the bad build, while one that lagged behind could not. The same trust problem has surfaced in other software supply-chain attacks, where the official update path became the delivery route.
What’s Next?
Two questions remain open in the disclosure as Wordfence summarizes it. How did malicious code reach Rank Math’s distribution channel? And how many customers downloaded an affected build, beyond Rank Math’s description of a limited number of users?
Rank Math says it has records of who downloaded an affected copy. Notified customers should follow its recovery steps even on a newer version. The company also says it won’t email login or download links, so owners should fetch 3.0.124 only by signing in at rankmath.com. If removed files reappear after cleanup, the job isn’t finished.
