WordPress: Malicious Version of Rank Math PRO SEO Plugin Distributed With Malware

Eleven hours. That is how long version 3.0.123 of Rank Math PRO, the paid edition of this widely used WordPress SEO plugin, was distributed with malware. If you installed and activated it during that window, your site should be considered compromised. Here is what you need to know.

When choosing an SEO plugin for your WordPress site, there are three main options: Rank Math SEO, Yoast SEO, and All in One SEO. This security alert concerns the first plugin on that list, in its PRO version. The page listed in the WordPress plugin directory claims more than 4 million active installations in total (including the free version).

On October 16, 2026, Rank Math published a security bulletin dedicated to version 3.0.123 of its PRO plugin. Affected users are those who downloaded this version, or performed the update, between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. That is between 10:02 PM and 9:12 AM Paris time.

"We immediately removed the affected files and released a clean version, Rank Math PRO v3.0.124," Rank Math explains. According to Wordfence, the vendor knows which customers retrieved a compromised copy, and its bulletin mentions an email sent to the people concerned. The incident is tracked under CVE-2026-111862.

Between the compromise of the UpdraftPlus infrastructure this weekend and this Rank Math PRO incident, WordPress is having a rough time right now.

Are you affected?

If you use WordPress and the Rank Math plugin, here are three scenarios and the actions to take for each one:

• Installed and activated during the period: the site should be considered compromised. The vendor recommends restoring files and the database from a backup taken before October 15, 2026, 20:02 UTC.
• Installed, but never activated: delete the plugin files, install version 3.0.124 from your Rank Math account, and run a security scan as a precaution.
• Downloaded, but neither installed nor activated: according to the vendor, this incident is not enough to indicate a compromise.

Be careful not to confuse updating with cleaning. Version 3.0.124 replaces the malicious plugin, but it does not remove files, accounts, or scheduled tasks created elsewhere by the malware. And if you want to know what this malware does, you will find the answer in the rest of this article.

A backdoor that rebuilds itself on every visit

According to Rank Math, the malware can recreate a hidden backdoor on every visit to the site. It provides persistent access to attackers and can expose credentials, API keys, and other secrets. That is why the cleanup order is important: you must first stop the rebuild mechanism. This means completely deleting the rank-math-pro directory (disabling the plugin is not enough), removing the malicious entry from the wp_options table (option_name _uf6qdn2hmm, _t8krdk990phb or _np5pvf754c) and, if possible, blocking outbound connections to rank1cdn[.]com.

Next, here are the traces to look for based on the information provided:

• Unknown administrator accounts: usernames starting with wpsupport_ followed by random characters, or email addresses ending in @wp-mail[.]net.
• Fake file added to the WordPress core: wp-includes/class-wp-cache-util.php is not a legitimate file. Delete it, then verify core integrity with the wp core verify-checksums command.
• .cache files executed as PHP: through rules added in .htaccess files.
• Scheduled tasks: entries marked #ms6v46 in the web server user's crontab, not to mention WP-Cron events.
• Suspicious PHP code: in wp-content/mu-plugins, other plugins and themes, with patterns such as base64_decode combined with XOR loops, the xmmqhn key, or proc_open.

Everything is detailed in the security bulletin published by Rank Math. And on top of that, you must absolutely rotate secrets: passwords, database credentials, wp-config.php keys and salts, API keys, FTP access, and SSH access.

"This issue only affects Rank Math PRO users. If you are using the free version of Rank Math SEO available on WordPress.org, your website is not affected and no action is required.", the notice says.

One last point: like many premium plugins, Rank Math PRO is downloaded from the vendor's customer account, not from the official repository. It therefore escapes the AI-based automated analysis that WordPress.org now applies to every plugin update. The entire trust chain rests on the vendor.

Florian Burnel Co-founder of IT-Connect

Systems and network engineer, co-founder of IT-Connect and Microsoft MVP "Cloud and Datacenter Management". I'd like to share my experience and discoveries through my articles. I'm a generalist with a particular interest in Microsoft solutions and scripting. Enjoy your reading.

See Full Bio