Rank Math SEO PRO malware demands full site recovery
Rank Math SEO PRO malware was distributed in some version 3.0.123 packages obtained between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math says websites that activated an affected copy should be considered compromised. The incident is a supply-chain compromise, meaning malicious code entered software delivered through a trusted product channel. Rank Math removed the affected files and issued version 3.0.124 as the clean replacement, but installing that release is not a complete recovery for an already affected site.
Wordfence Intelligence tracks the issue as CVE-2026-111862 and assigns it a 9.8 Critical score under the Common Vulnerability Scoring System, or CVSS, a standard scale for rating security flaws. The affected software is Rank Math SEO PRO, identified by the slug seo-by-rank-math-pro, and the researcher is listed as unknown. According to Rank Math, the malicious code could create persistent access, contact rank1cdn[.]com and rebuild a hidden backdoor, which is a concealed way to regain control of a site, when someone visited the website. It could also expose WordPress passwords, database credentials, application programming interface keys and other secrets available to the web server.
Version 3.0.123 alone is not proof of infection. Rank Math limits the affected group to packages downloaded or installed through an update during the stated window. A site that activated one of those packages requires full recovery. If the plugin was installed but never activated, Rank Math advises deleting its files, installing version 3.0.124 from the customer account and running a security scan. If the package was only downloaded and never installed or activated, Rank Math says this incident alone does not indicate that the website was compromised. The company says it has records identifying affected downloads, so anyone it notified should follow the recovery instructions even if the site now runs another version.
The preferred recovery path is to restore both the website and its database from a clean backup made before October 15, 2026 at 20:02 UTC. Rank Math then recommends scanning the restored site, replacing every sensitive credential the website could access and installing version 3.0.124 directly from the Rank Math account. Site owners should replace WordPress and database passwords, WordPress security keys and salts, payment and email service credentials, API keys, hosting control-panel logins and FTP, SFTP or SSH credentials. Administrator two-factor authentication settings should also be reviewed. Two-factor authentication adds a second login check beyond a password.
Where no suitable backup exists, Rank Math recommends manual cleaning by an experienced security professional or hosting provider if the owner is not comfortable changing website files, database entries and server settings. Before removing other suspicious material, administrators should delete the entire rank-math-pro plugin directory rather than merely deactivate it. They should then remove wp_options entries named _uf6qdn2hmm, t8krdk990phb and _np5pvf754c. The wp_options table stores WordPress site settings. Outgoing access to rank1cdn[.]com should also be blocked where the host or firewall supports that action. This order matters because Rank Math says the malicious mechanism can recreate its hidden backdoor during a page visit.
Rank Math lists several further indicators that require investigation. These include unfamiliar administrator names beginning with wpsupport_, accounts using addresses ending in @wp-mail[.]net and a file at wp-includes/class-wp-cache-util.php, which Rank Math says is not a legitimate WordPress core file. Administrators should look for unexpected PHP files in wp-content/mu-plugins/, other plugin directories, the inc/, includes/ and lib/ directories of non-default themes, the Rank Math includes/ directory and the WordPress uploads directory. PHP is the programming language used by WordPress. Suspicious code may contain base64_decode with XOR loops, the key xmmqhn, proc_open or PHP-FPM socket code.
Server checks should include root and subdirectory .htaccess files containing rules that let .cache files execute as PHP, as well as .cache files that contain PHP code. Rank Math also identifies system cron tasks carrying the marker #ms6v46. Cron is a service that automatically runs commands on a schedule. Administrators should review WordPress scheduled events, scheduled tasks owned by other system users, running processes, SSH authorized keys and locations outside the website directory where the web server is allowed to write. Finding none of these signs does not prove that the site is clean, because the attacker may have created other files, accounts, tasks or server-level changes.
After cleanup, Rank Math recommends a full security scan and continued monitoring for unusual behaviour or deleted files returning. WordPress core files can be checked with the command wp core verify-checksums, while installed plugins can be checked with wp plugin verify-checksums --all. Checksums are digital fingerprints used to identify changed files. They are not available for every premium plugin, so those files should be compared with a clean copy obtained directly from the developer. Outgoing connections should also be monitored, and reappearing suspicious files should be treated as evidence that recovery remains incomplete.
The clean plugin should be obtained by navigating directly to rankmath.com and signing in, rather than following a message link. Rank Math says it will not email login or download links, making unexpected messages containing them suspicious. Rank Math published its security notice on October 16, 2026 and identifies that notice as the authoritative place for incident updates. For readers reviewing where their WordPress site runs, AEU Hosting is managed WordPress hosting, secured end to end. Regardless of hosting arrangement, an activated affected package requires restoration or careful manual cleaning, comprehensive credential replacement and checks across both the website and its server.