Rank Math PRO hacked: version 3.0.123 shipped with a backdoor

For about eleven hours on October 15 and 16, 2026, copies of Rank Math PRO 3.0.123 served by the developer contained malware. If you use the paid version, check when this version reached your sites: if it was activated during that window, the site must be treated as hacked. Here is what is known as of October 20, the traces to look for and the order in which to clean up.

What happened

Rank Math released version 3.0.123 of its PRO plugin on October 7, 2026: an ordinary update. The problem comes from packages served a week later under the same version number.

• October 14, 7:31 p.m. UTC (9:31 p.m. in Paris): the domain rank1cdn.com, which the developer now asks users to block, is registered, according to Verisign's RDAP registry.
• October 15, 8:02 p.m. UTC (10:02 p.m. in Paris): start of the period during which trojanized copies of 3.0.123 are distributed, by download from rankmath.com or by update.
• October 16, 7:12 a.m. UTC (9:12 a.m. in Paris): end of that period.
• October 16: Rank Math removes the affected files and releases the clean version 3.0.124. Its security advisory goes online at 8:32 p.m. UTC; the developer says it has notified the affected customers.
• October 17: alerts from Wordfence and Patchstack, CVSS score of 9.8 out of 10.
• October 19: Wordfence publishes the CVE-2026-111862 record ("embedded malicious code", CWE-506); the security press picks up the story.

Rank Math has not explained how the files got into its distribution system, nor how many customers received a trojanized copy; BleepingComputer did not get an answer on these points. No perpetrator has been named.

Who is affected

Only the paid plugin is involved: it is downloaded and updated from rankmath.com, not from wordpress.org. The free Rank Math SEO plugin, which has more than 4 million active installations (wordpress.org), is not affected according to the developer. The number of PRO installations is not public.

Item	Details
Product	Rank Math SEO PRO (folder rank-math-pro)
Affected version	3.0.123, only copies obtained from October 15, 8:02 p.m. to October 16, 7:12 a.m. UTC
Clean version	3.0.124 (October 16, 2026)
Identifier	CVE-2026-111862 (CWE-506, embedded malicious code)
Severity	9.8 out of 10, critical (Wordfence and Patchstack)
Account required for the attacker	None: the code ships with the plugin
Condition	Plugin activated on the site
Free version (wordpress.org)	Not affected according to Rank Math

Showing 3.0.123 proves nothing: a copy obtained before October 15 at 8:02 p.m. UTC is clean. Only the download or installation date matters. The developer distinguishes three cases.

Your situation during the window	What Rank Math says	What to do
3.0.123 installed and activated	Site to be considered compromised	Restore or fully clean up, then change every secret
3.0.123 installed, never activated	No compromise reported	Delete the files, install 3.0.124, run a scan
3.0.123 downloaded, neither installed nor activated	Nothing indicates a compromise	Delete the archive, use 3.0.124

Rank Math says it knows which accounts received a trojanized copy: if it has written to you, follow its procedure, even if the site is already on 3.0.124.

How this backdoor works

This is a supply chain attack: the attacker slips their code into software you install in good faith, from the official source. As Patchstack notes, no firewall rule can stand in the way: the code is part of the plugin.

According to Rank Math's advisory, as summarized by Wordfence, the code runs when the plugin is activated. It can then:

• gain a foothold in the database (three wp_options entries) and recreate a hidden backdoor on every visit;
• drop PHP files elsewhere: in wp-content/mu-plugins/, in other plugins or themes, and a fake core file;
• modify .htaccess so that .cache files are executed as PHP;
• create administrator accounts and scheduled tasks, including at the system level;
• communicate with rank1cdn.com and expose any secret readable by the server: passwords, database, API keys.

This rebuilding mechanism is what makes updating insufficient. Installing 3.0.124 replaces the plugin folder, but not the files, accounts and tasks dropped elsewhere. And deleting a suspicious file before neutralizing the database entries may be pointless: it comes back on the next visit.

Indicators of compromise: checking your site

The indicators below are those published by Rank Math and relayed by Wordfence. Their presence must be investigated; their absence, Wordfence warns, does not on its own prove that the site is clean.

In WordPress

• Entries _uf6qdn2hmm, t8krdk990phb or _np5pvf754c in the wp_options table.
• Unknown administrators whose username starts with wpsupport_, or whose email address ends in @wp-mail.net.
• A wp-includes/class-wp-cache-util.php file: it is not a WordPress file.
• Unexpected PHP files in wp-content/mu-plugins/, in other plugins' folders, in the inc/, includes/ and lib/ folders of non-default themes, in Rank Math's includes/ folder and in uploads/.
• PHP code that combines base64_decode and XOR loops, contains the key xmmqhn, calls proc_open or talks to the PHP-FPM socket.

With WP-CLI, from the site root:

wp plugin list --fields=name,version,status
wp db query "SELECT option_name FROM $(wp db prefix)options WHERE option_name IN ('_uf6qdn2hmm','t8krdk990phb','_np5pvf754c')"
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
wp core verify-checksums
wp cron event list
grep -rl "xmmqhn" wp-content wp-includes
find wp-content -name "*.php" -newermt "2026-10-15 20:00"

The wp core verify-checksums command flags extra files in wp-includes, including the fake core file. The date in the find command follows the server's time zone. wp plugin verify-checksums only works for plugins published on wordpress.org: there are no public checksums for Rank Math PRO, which you need to compare with a clean copy downloaded from your account.

On the server

• Outbound connections to rank1cdn.com (firewall or hosting provider logs).
• Rules in an .htaccess file, at the root or in a subfolder, that make .cache files run as PHP, and .cache files containing PHP.
• Scheduled tasks of the web server user carrying the #ms6v46 marker (crontab -l), other users' crontabs, SSH keys added to authorized_keys, unknown processes.

What to do now

If a trojanized copy was activated, Rank Math first recommends restoring the files and the database from a backup made before October 15, 2026, 8:02 p.m. UTC, then scanning the site, changing every credential and only then installing 3.0.124. Without a clean backup, manual cleanup follows a precise order:

1. Delete the wp-content/plugins/rank-math-pro folder entirely (deactivating it is not enough).
2. Delete the three wp_options entries listed above, for example with wp option delete _np5pvf754c.
3. Block outbound connections to rank1cdn.com if your hosting provider or firewall allows it.
4. Only then delete the other files, accounts and tasks listed above, and reinstall WordPress, plugins and themes from trusted sources.
5. Change every secret, even after a restore: WordPress passwords, database credentials and the security keys in wp-config.php (wp config shuffle-salts), application passwords, API keys (payment, email sending), hosting, FTP, SFTP and SSH access, then review two-factor authentication for administrators.
6. Install 3.0.124 by logging in directly at rankmath.com: the developer never sends download links by email.
7. Keep monitoring the site: if deleted files reappear, the cleanup is incomplete.

Keep a copy of the compromised site for analysis first. Our procedure for cleaning up a hacked WordPress site details each step; if needed, hand the job over to your hosting provider or a specialist.

Reducing exposure next time

Smart Slider 3 Pro in April and ShapedPlugin's Pro plugins in June were already trojanized through their developer's update channel (see these supply chain attacks). A few habits limit the damage:

• Updates: keep security patches automatic, but for a mere maintenance release of a premium plugin, a delay of a few days gives an incident time to be detected (see our automatic update strategies).
• Monitoring: follow the advisories of the developers of your paid plugins and vulnerability alerts for all your sites.
• Least privilege: few administrators, all with named accounts, so an intruder stands out quickly (roles and least privilege).
• Backups: daily, off the server, covering several weeks; that is the recovery method recommended here.
• Firewall: a WAF and virtual patching protect against vulnerabilities exploited from outside, not against code shipped inside a plugin; filtering outbound connections, on the other hand, can cut the channel to a domain like rank1cdn.com.

WP Masquerade Pro helps with some of these points, within limits. Its vulnerability alerts compare installed versions with the WPVulnerability.net database every day and notify you by email, but only for wordpress.org plugins and themes: Rank Math PRO is not checked, and a backdoor is only reported once it is listed in a database. The integrity check only monitors WordPress core; it would, however, have flagged an unknown PHP file such as wp-includes/class-wp-cache-util.php.

The activity log records accounts created, roles changed and plugins installed or updated, which helps date the installation of 3.0.123; it only starts when it is activated and does not see what bypasses WordPress. Finally, the member area brings together the pending updates and vulnerable sites of all your sites. WP Masquerade alerts: it does not fix anything and replaces neither a firewall nor a backup. For context, see also the full history of Rank Math vulnerabilities.

Sources

• Rank Math: Changelog, Rank Math PRO v3.0.124 (October 16, 2026) (external link, opens in a new tab)
• CVE.org: CVE-2026-111862, Rank Math SEO PRO 3.0.123, Unauthenticated Embedded Malicious Code (October 19, 2026) (external link, opens in a new tab)
• WordPress.org: Rank Math SEO (free plugin) (external link, opens in a new tab)
• WP-CLI: wp core verify-checksums (external link, opens in a new tab)

Other sources consulted: official vendor pages, trade press articles, Wordfence and Patchstack databases.