Rank Math has warned that some Rank Math PRO 3.0.123 packages downloaded or installed through updates during an 11-hour window on Oct. 15 and 16 contained malware, turning what would normally look like a routine premium plugin update into a supply-chain incident for affected WordPress sites.
The vendor said the affected window ran from Oct. 15, 2026, at 20:02 UTC to Oct. 16 at 07:12 UTC, or about 4:02 p.m. Eastern time on Oct. 15 to 3:12 a.m. Eastern time on Oct. 16. Rank Math said it removed the affected files and released 3.0.124 as the replacement release.
The affected group is narrower than Rank Math’s public reach
The notice applies to Rank Math PRO, the paid plugin delivered through Rank Math’s own account and update systems. Rank Math said the free Rank Math SEO plugin available from WordPress.org was not affected.
WordPress.org’s plugin page describes the free Rank Math SEO plugin as used on more than 4 million WordPress websites. That figure should not be read as the affected population. The incident notice is limited to PRO 3.0.123 packages obtained during the stated window, and Rank Math has described the affected audience as a limited number of users.
Rank Math’s public notice, reviewed Oct. 21, did not state how the malicious files entered its delivery system, how many customers received affected packages, or whether file hashes for affected and unaffected packages would be published. Rank Math has also not said whether automatic updates delivered the tainted package to any sites. BleepingComputer reported that it contacted Rank Math for details on the number of potentially affected sites and the initial attack vector but had not received a response by publication.
Why the version number alone is not enough
The critical dividing line is not the version currently shown in the WordPress dashboard. It is whether a Rank Math PRO 3.0.123 package obtained during the affected window was installed and activated.
Rank Math’s own guidance separates sites into three groups:
Installed and activated an affected package: Treat the site as compromised and follow recovery steps, even if the plugin has since been updated.
Installed but never activated: Delete the affected plugin files, install Rank Math PRO 3.0.124 from the Rank Math account area, and run a security scan.
Downloaded but never installed or activated: Rank Math says there is no indication from this incident alone that the site was compromised.
Wordfence echoed the same warning and said updating replaces the plugin package but does not remove malicious files, administrator accounts, or scheduled tasks that the malware may already have created elsewhere on the server.
This makes update timing unusually important. Rank Math’s changelog lists 3.0.123 as an Oct. 7 release and 3.0.124 as an Oct. 16 release that addressed the malware incident. Because the affected period came after 3.0.123 was already available, the version number by itself cannot prove that a site received an affected copy.
What the malware may have left behind
Rank Math said the malware can recreate a hidden backdoor when a site is visited. Wordfence’s vulnerability record tracks the incident as CVE-2026-111862, rates it 9.8 critical, and describes the issue as unauthenticated embedded malicious code affecting a subset of Rank Math SEO PRO 3.0.123 packages.
Indicators named by Rank Math and repeated by Wordfence include malicious wp_options entries named _uf6qdn2hmm, t8krdk990phb, and _np5pvf754c; outbound connections to rank1cdn[.]com; unauthorized administrator accounts beginning with wpsupport_; and accounts using email addresses ending in @wp-mail[.]net.
Other indicators include the fake WordPress core file wp-includes/class-wp-cache-util.php, suspicious PHP files in wp-content/mu-plugins/, plugin folders, theme folders, and uploads, rules that allow .cache files to execute as PHP, .cache files containing PHP code, and system cron entries tagged #ms6v46.
Wordfence cautioned that the absence of those indicators does not prove a site is safe.
BleepingComputer also reported finding a PHP sample on VirusTotal that appeared connected to the same compromise because it contained several of the same indicators. The outlet said it could not confirm whether that file was distributed through the compromised plugin, so the sample may help defenders hunt for related activity but should not be treated as proof of what every affected Rank Math package did.
Rank Math’s recovery guidance
For sites where an affected copy was activated, Rank Math recommends restoring the website files and database from a backup created before Oct. 15 at 20:02 UTC. After restoration, administrators are told to scan the site, replace passwords and other secrets, and then install Rank Math PRO 3.0.124 from the Rank Math account area.
If no suitable backup exists, Rank Math recommends manual remediation in a specific order. The first steps are to delete the entire rank-math-pro plugin folder, remove the three named malicious wp_options entries, and block outgoing connections to rank1cdn[.]com if the hosting provider or firewall supports it.
The order matters because Rank Math says the malware may recreate its hidden backdoor when the site is visited. The vendor also says deactivating the plugin alone is not sufficient.
Rank Math’s credential guidance is broad. Administrators are told to assume that secrets accessible to the compromised site may have been exposed, including WordPress passwords, database credentials in wp-config.php, WordPress security keys and salts, payment gateway or SMTP credentials, API keys, hosting control panel logins, FTP, SFTP or SSH credentials, environment secrets, and relevant two-factor authentication settings.
After remediation, Rank Math recommends running security scans, verifying WordPress core checksums, checking plugin files where checksums are available, monitoring outgoing connections, and watching for removed files that reappear. Premium plugins may not have public checksums, so comparison against a known-good copy from the developer may be needed.
Rank Math also told users to navigate directly to rankmath.com to download 3.0.124 and said it will not send login or download links by email. Unexpected messages containing those links should be treated as suspicious.
Free Rank Math users may still see account effects
Rank Math said the free WordPress.org plugin was not affected and that no security action is needed for users of that version because of this incident alone.
However, Rank Math also said it refreshed some systems during its response. As a result, some free accounts registered between Oct. 13 and Oct. 16, 2026, were removed. According to Rank Math, affected users were emailed instructions to recreate the account, and SEO settings, metadata, and content on the WordPress site were not affected.
Why update records matter
Automatic update emails, activity logs, deployment records, backup timestamps, and server file modification times may be more useful than the dashboard version number once a site has already moved to 3.0.124. The incident also shows why premium plugin update channels need the same audit trail as core WordPress, themes, and public repository plugins.
Get new small business insights by email
Practical ideas and useful articles to help you make better business decisions.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
