Rank Math PRO update channel served a persistent backdoor
Rank Math PRO packages downloaded from the vendor's website or delivered through its update system between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, according to a Rank Math security notice. Any website that installed and activated one of those packages should be considered compromised. The malware can restore its hidden backdoor, a concealed route for remote access, whenever somebody visits the affected website.
Rank Math removed the affected downloads and issued clean version 3.0.124. However, Wordfence warned that installing this release only replaces the plugin, which is an add-on that extends WordPress. It does not remove malicious files, administrator accounts or scheduled tasks, meaning automated jobs, that may already have been created elsewhere on the server. An update to 3.0.124 therefore does not establish that a previously affected website is safe.
The displayed version number cannot identify every compromised package. Rank Math's changelog dates version 3.0.123 to October 7, while the malicious distribution window began more than a week later. A copy obtained before 20:02 UTC on October 15 falls outside the identified period. Sites that installed and activated 3.0.123 during the window require full incident recovery. If the plugin was installed but never activated, Rank Math advises deleting it, downloading 3.0.124 through the customer's account and running a security scan. Merely downloading the package without installing or activating it does not, by itself, indicate that the website was compromised.
Rank Math has contacted some users by email and directs uncertain customers to its support team. The incident applies only to the paid PRO plugin distributed through rankmath.com. The free Rank Math SEO plugin on WordPress.org, which listed more than 4 million active installations and was last updated on October 6, was not included in the notice.
Rank Math's notice describes several changes the malware may have made, although neither that notice nor Wordfence's advisory provides a code analysis or identifies the attacker. Possible remnants include PHP backdoor files placed in other plugin directories, theme directories and the must-use plugins directory. PHP is the programming language commonly used to run WordPress. The malware may also have created administrator accounts, installed a false WordPress core file, changed .htaccess configuration so files ending in .cache execute as PHP, or added scheduled tasks and SSH keys, which can permit server logins without a password. Rank Math warns that any password, database credential, application programming interface key or other secret accessible to the site may have been exposed.
Wordfence assigned CVE-2026-111862 and rated it 9.8 out of 10, listing the researcher as unknown. A CVE is a standard public identifier for a security issue. Patchstack classifies the incident as a backdoor and says it cannot provide a mitigation rule because the compromise occurred in Rank Math's own systems.
Rank Math recommends restoring both the website and its database from a backup created before 20:02 UTC on October 15, when such a backup is available. Owners should then scan the restored site, replace every password and credential, and install 3.0.124 directly from their Rank Math account. Credentials still need to be changed after a restoration because secrets available to the compromised site may already have been collected.
Without a clean backup, the order of manual cleanup is important because visiting the site can recreate the backdoor. First, remove the entire rank-math-pro directory through the hosting file manager or File Transfer Protocol (FTP); simply switching the plugin off is insufficient. Second, delete entries named _uf6qdn2hmm, t8krdk990phb and _np5pvf754c from the wp_options database table, where WordPress stores site settings. Third, block outbound connections to rank1cdn[.]com where the hosting provider or firewall permits it.
Administrators must then search for PHP files in wp-content/mu-plugins/, other plugin folders, uploads/, Rank Math's includes/ directory, and the inc/, includes/ and lib/ directories of non-default themes. The indicators listed by Rank Math include base64_decode combined with XOR loops, the key xmmqhn, proc_open and PHP-FPM socket code. The file wp-includes/class-wp-cache-util.php should also be investigated because it is not part of WordPress core.
Account checks should look for administrator names beginning with wpsupport_ and email addresses ending in @wp-mail[.]net. Server-level checks cover .htaccess rules that execute .cache files as PHP, PHP code inside .cache files, crontab entries marked #ms6v46, WordPress scheduled events, SSH authorized_keys files, other users' crontabs, running processes and writable locations outside the website. Wordfence cautions that not finding these indicators does not prove a site is clean.
The credential reset should include WordPress accounts, the database login in wp-config.php, WordPress security keys and salts, payment gateway credentials, Simple Mail Transfer Protocol (SMTP) email credentials, other API keys, the hosting control panel, FTP, Secure File Transfer Protocol (SFTP), SSH access and secrets stored in environment variables. Rank Math also advises enabling two-factor authentication for administrators, which requires a second sign-in check beyond a password.
Final verification includes another security scan, wp core verify-checksums for WordPress core files and wp plugin verify-checksums --all for plugins. A checksum is a calculated fingerprint used to detect altered files, but premium plugins may not have public checksum records. WordPress.org does not publish them for this PRO plugin. The Hacker News checked the plugin-checksums service on October 19 and found no record under either PRO plugin name, although a record was available for the free edition.
The clean 3.0.124 package should be installed last by navigating directly to rankmath.com and signing in. Rank Math says some customers may need to reset their account password, without explaining why, and says it will not send login or download links by email. For owners reviewing how their sites are run after an incident like this, AEU Hosting offers managed WordPress hosting, secured end to end.
Rank Math, part of Swedish hosting group group.one, has not disclosed how the malicious files reached its download and update infrastructure, how many customers received them, whether automatic updates were involved, or the file hashes of the clean and compromised packages. Registry records show that rank1cdn[.]com was registered at 19:31 UTC on October 14, roughly a day before the distribution window opened.
This was at least the third case during the same year in which a vendor-managed update channel for a premium WordPress plugin distributed backdoored software.
Also available in: Italiano