Rank Math PRO 3.0.123 Malware: How to Check Your Site

On October 16, 2026, Rank Math reported that some copies of Rank Math PRO 3.0.123 contained malware. Only copies downloaded, or installed through an update, between October 15 at 20:02 UTC and October 16 at 07:12 UTC are affected. Rank Math says the malware can compromise a site once the plugin is activated. If one of your sites updated to 3.0.123 in that window and the plugin was active, treat the site as compromised and start from a clean backup.

This guide summarizes Rank Math’s own notice and the public advisory, checked October 19, 2026. Rank Math’s notice is the authority, and it may change as their investigation continues: Rank Math PRO 3.0.123 Security Incident.

What happened

Rank Math says a limited number of users who downloaded Rank Math PRO 3.0.123 during the window received plugin files that contained malware. According to the notice, the malware can rebuild its hidden backdoor whenever someone visits the site, and attackers may have left other files, accounts, scheduled jobs and server changes behind. Rank Math removed the affected files and released 3.0.124 as a clean version. The 3.0.124 entry in Rank Math’s changelog lists only bug fixes, so the knowledge base notice is where the incident is described.

Wordfence tracks the incident as CVE-2026-111862 and rates it 9.8, critical. Its public service announcement reports that the malware contacts a domain, rank1cdn[.]com, and can expose WordPress and database credentials, API keys and other secrets the web server can read.

Rank Math says the issue affects Rank Math PRO users only, so the free plugin from WordPress.org needs no action. Two things are not known yet: Rank Math has not said how the files were altered or how many sites received them.

Was your site affected

Rank Math’s notice separates three cases:

• Installed or updated to 3.0.123 in the window, and activated. Treat the site as compromised and follow the cleanup below.
• Installed in the window but never activated. Delete the plugin’s files, install 3.0.124 and run a security scan.
• Downloaded in the window but never installed. Rank Math says there is no indication of compromise from this incident alone. Delete the download.

Version 3.0.123 itself was first released on October 7, according to Rank Math’s changelog. A site that updated before October 15 at 20:02 UTC got a copy from outside the window. To find out when a site updated, check your host’s file change log, your backup history, or the modified dates of the files in the plugin’s folder. If you cannot tell, assume the site updated in the window.

Signs the malware was installed

Rank Math lists these indicators. Any one of them means the site needs cleanup:

• Rows in the wp_options table named _uf6qdn2hmm, t8krdk990phb or _np5pvf754c
• Outbound connections to rank1cdn[.]com
• A file at wp-includes/class-wp-cache-util.php, which is not part of WordPress
• Administrator accounts named wpsupport_ followed by random characters, or with email addresses ending in @wp-mail.net
• .htaccess rules that let .cache files run as PHP, and .cache files that contain PHP
• PHP files in the uploads folder, or PHP that uses base64_decode with XOR loops, the key xmmqhn, proc_open or PHP-FPM socket code
• A server crontab entry tagged #ms6v46

Not finding these does not prove a site is clean, because the malware can rebuild itself and attackers may have changed other files.

How to clean up a site

Rank Math recommends restoring a backup first. Restore both the files and the database from a backup made before October 15, 2026 at 20:02 UTC. Then scan the site, change every credential listed below, and install 3.0.124 from your Rank Math account.

A restore removes the malware’s files, but it cannot undo what happened while the plugin was active. Credentials the site could read may already have been copied, and a WordPress backup does not include the server’s crontab or SSH keys. So even after a clean restore, change the credentials and check the server for the crontab entry and SSH keys you did not add.

If there is no clean backup, Rank Math’s manual steps run in this order. If you are not comfortable working on files and the database, ask your host or a security service to do it.

1. Stop the malware rebuilding itself. Delete the whole Rank Math PRO plugin folder; deactivating it is not enough. Delete the three wp_options rows listed above, and block outbound connections to rank1cdn[.]com if your host allows it.
2. Remove what it left behind. Check wp-content/mu-plugins, other plugins’ folders, the inc, includes and lib folders of your theme, the uploads folder, administrator accounts, .htaccess, .cache files, WordPress scheduled events, server crontabs, SSH keys, running processes, and writable folders outside the site.
3. Change every credential the site could read. That means WordPress passwords, the database password, the security keys and salts in wp-config.php, API keys, email and payment credentials, and hosting, FTP and SSH access. Review two-factor settings for every administrator.
4. Verify. Run a malware scanner. Run wp core verify-checksums, and wp plugin verify-checksums --all for plugins from WordPress.org. Premium plugins are not in that check, so compare them with fresh copies from each vendor. Watch outbound connections, and check that the files you removed do not come back.

Download 3.0.124 only by signing in at rankmath.com. Rank Math notes that some users may need to reset their account password before they can sign in. It also says it never sends login or download links by email, so treat any email offering one as phishing.

If you manage client sites

List every site that runs Rank Math PRO and check each one against the window, not only the version. wp plugin list --fields=name,version,status on each site shows the installed version, and your host’s logs or backups show when it changed. Tell affected clients plainly what happened and what you changed, especially the credentials, since their own accounts and integrations may need new keys.

Do not switch SEO plugins as a way out of this. Moving to another plugin does not remove malware from a site. Clean the site first. If you decide to change plugins afterward, Migrate From Rank Math walks through a switch to WP Visibility with a verification step.

What this means for every plugin you install

Any plugin vendor’s update channel can be compromised, and WP Visibility ships its updates through its own channel too. The protections that worked here are the ordinary ones: a backup from before each update that you can restore quickly, few administrator accounts, credentials you can rotate in an afternoon, and a habit of reading a vendor’s security notice before deciding what to do.

Sources, checked October 19, 2026: Rank Math’s security notice, the Wordfence announcement, the Wordfence vulnerability record, CVE-2026-111862 and Rank Math’s changelog.