Rank Math PRO update breach demands full WordPress incident response
Rank Math has warned that copies of its paid Rank Math PRO WordPress SEO plugin downloaded from rankmath.com or installed through updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware. The vendor says any website that installed and activated one of those copies should be treated as compromised.
The affected package can establish a hidden backdoor that recreates itself when someone visits the website. Rank Math has removed the affected files and released a clean version, 3.0.124, but replacing the plugin alone does not remove malware components that may already have been written elsewhere on a server.
Version number is not enough to identify exposure
Rank Math’s notice applies only to the PRO plugin, which customers obtain and update through rankmath.com. The free Rank Math SEO plugin distributed through WordPress.org is not named in the incident. The version number alone is not a reliable exposure test: version 3.0.123 was dated October 7, while Rank Math limits the incident to copies downloaded or updated during the stated window.
A site that obtained version 3.0.123 before 20:02 UTC on October 15 falls outside that window. A site that installed and activated it during the window should be handled as compromised, including when it has subsequently upgraded to 3.0.124. Users who downloaded the package without installing or activating it have no indication from this incident alone that their website was compromised.
Backdoor persistence expands the cleanup scope
Rank Math and Wordfence warn that the malware may have placed PHP backdoors in plugin, theme or must-use plugin directories; created administrator accounts; added a false WordPress core file; changed .htaccess rules so that .cache files execute as PHP; and created scheduled tasks or SSH keys. Wordfence assigned the incident CVE-2026-111862 and rated it 9.8 out of 10.
The vendors have not published a code analysis or identified the actor responsible. Rank Math also has not disclosed how the malicious files entered its download and update system, how many customers received them, whether automatic updates delivered them, or hashes for the clean and tainted packages.
For sites with a backup predating 20:02 UTC on October 15, Rank Math’s preferred response is to restore both the site and database, scan the restored environment, rotate credentials, and only then install 3.0.124 from the Rank Math account. Credentials requiring replacement include WordPress and database passwords, WordPress security keys and salts, hosting and remote-access credentials, API keys, environment secrets, and administrator two-factor authentication.
Manual recovery must begin by disabling persistence
Where no clean backup exists, Rank Math specifies an order of operations. Administrators should first delete the entire rank-math-pro folder rather than merely deactivate the plugin, remove the _uf6qdn2hmm, t8krdk990phb, and _np5pvf754c entries from wp_options, and block outbound connections to rank1cdn[.]com where their provider or firewall permits it.
Only after those actions should teams search for implanted files, altered accounts, cron entries, WordPress scheduled events, SSH authorized keys, suspicious processes and writeable locations outside the site. Rank Math highlights PHP using base64_decode with XOR loops, the key xmmqhn, proc_open, or PHP-FPM socket code, as well as wp-includes/class-wp-cache-util.php, which is not a WordPress core file.
Wordfence cautions that the absence of these indicators does not prove a site is clean. The final checks include a security scan, wp core verify-checksums, and wp plugin verify-checksums --all, although premium-plugin checksums may not be available. For affected businesses, the practical implication is to treat a vendor update channel compromise as a server-wide incident, preserve evidence where required, rotate all reachable secrets, and validate recovery before returning the site to normal operation.