Rank Math PRO Hacked: Malware Backdoored WordPress Sites

Rank Math PRO 3.0.123 shipped with malware from the vendor own site, backdooring WordPress sites. Free version is safe. Here is what happened and what to do.

Some copies of Rank Math PRO, the paid WordPress SEO plugin, were downloaded from the vendor's own website carrying malware. The company says affected versions were served for about 11 hours, between October 15 and 16. If one of those copies was installed and activated, the website should be treated as compromised. The free version of the plugin is not affected.

What happened

Rank Math said in a security notice on October 16 that some downloads of Rank Math PRO version 3.0.123 from its official website contained malware. The tainted copies were available between 20:02 UTC on October 15 and 07:12 UTC on October 16. Activating the plugin could compromise a website. This was a supply-chain attack: the malware did not come from a hacked third-party site or a fake download page. It came from Rank Math's own distribution channel, the same place paying customers are supposed to get safe updates. The company removed the affected files and released a clean version, 3.0.124. But updating does not clean an infected site. The malware leaves behind files, administrator accounts, and scheduled tasks elsewhere on the server, so the site stays compromised even after the update.

What the malware does

According to Rank Math's notice, the malware establishes persistent access and communicates with the domain rank1cdn[.]com. It can recreate its hidden backdoors whenever someone visits the infected site. Installing the compromised version could also expose database credentials, API keys, and other secrets available to the web server. BleepingComputer found a PHP malware sample on VirusTotal that shares indicators of compromise with Rank Math's alert, including an XOR obfuscation key, a WordPress database entry, and code that creates administrator accounts. The sample also showed the ability to run commands and look for cloud credentials, though BleepingComputer could not confirm it was distributed through the compromised plugin. Wordfence assigned the incident CVE-2026-111862 and rates it 9.8 out of 10, with the researcher listed as unknown.

A pattern this year

This is at least the third time this year that a premium WordPress plugin's vendor-run update channel has delivered backdoored builds. In April, Nextend's update system served a backdoored Smart Slider 3 Pro for about six hours. In June, ShapedPlugin's Pro plugins were found backdoored in its update channel. Rank Math has not said how the malicious files entered its download and update system, how many customers received one, or whether automatic updates delivered them. Its only statement about the future is that the team is taking steps to reduce the risk of similar incidents.

How to recover

The notice sorts sites into three cases. If you installed and activated 3.0.123 during the window, treat the site as compromised, even if it has since been updated to 3.0.124. If you installed it but never activated it, delete the plugin files, install 3.0.124 from your Rank Math account, and run a security scan. If you only downloaded it, nothing in this incident alone indicates compromise. Rank Math's preferred recovery is a restore from a backup made before October 15, 20:02 UTC. Restore both the site files and the database, run a security scan, change every password and credential, and only then install 3.0.124. Without a clean backup, cleanup must run in a fixed order. First, delete the entire rank-math-pro plugin folder - deactivating alone is not enough. Then delete malicious database entries, and block outgoing connections to rank1cdn[.]com. After that, hunt for leftover backdoors, rogue administrator accounts, suspicious scheduled tasks, and altered server files. In every case, rotate all credentials: WordPress passwords, database credentials, API keys, hosting access, and SSH keys. Note that the version number alone does not show whether a copy is affected. Rank Math dates 3.0.123 to October 7, more than a week before the attack window, so only the download or update time tells you if a copy is tainted.

Sources

BleepingComputer: https://www.bleepingcomputer.com/news/security/wordpress-seo-plugin-rank-math-compromised-to-backdoor-websites/ The Hacker News: https://thehackernews.com/2026/10/popular-wordpress-seo-plugin-rank-math.html Rank Math: https://rankmath.com/kb/pro-3-0-123-security-incident/