Rank Math has disclosed that some downloads of its Rank Math SEO PRO WordPress plugin version 3.0.123 contained malware, prompting the company to urge affected site owners to treat any website that activated the bad package as compromised. The vendor says it removed the malicious files and released version 3.0.124 as the clean replacement, but updating alone is not enough if the infected build was already active on a site.
What Rank Math says happened
According to the company’s security notice, the issue affected a subset of Rank Math SEO PRO 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math says version 3.0.123 by itself does not prove a website was compromised; the concern is specifically for sites that downloaded or updated during that window and then activated the plugin.
Wordfence Intelligence classifies the issue as “Unauthenticated Embedded Malicious Code” with a CVSS score of 9.8 and tracks it as CVE-2026-111862. The affected software is listed as Rank Math SEO PRO [seo-by-rank-math-pro], and the patched version is 3.0.124.
Why a simple update may not be enough
Rank Math warns that if an affected copy of 3.0.123 was active, the site should be considered compromised. The malware may have created additional files, administrator accounts, or scheduled tasks elsewhere on the server, which means replacing the plugin alone may leave the rest of the infection in place.
The company says the malicious code could establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors when a page is visited, and expose sensitive data accessible to the web server. That includes WordPress credentials, database credentials, API keys, and other stored secrets.
What site owners should check first
Rank Math divides affected users into three groups:
- Activated an affected copy: Treat the site as compromised and complete a full recovery.
- Installed version 3.0.123 but never activated it: Delete the affected plugin files, install version 3.0.124 from the Rank Math account, and run a security scan.
- Downloaded version 3.0.123 but never installed or activated it: Rank Math says there is no indication from this incident alone that the website was compromised.
The company also says it has records identifying users who downloaded an affected copy. If Rank Math contacted you directly, it says to follow its recovery instructions even if the site is now running a different version.
Rank Math SEO PRO 3.0.123 cleanup steps
For sites that activated an affected build, Rank Math recommends restoring the website and database from a clean backup created before October 15, 2026 at 20:02 UTC. After restoration, the site should be scanned, sensitive credentials should be changed, and Rank Math SEO PRO 3.0.124 should be installed directly from the user’s Rank Math account.
If no suitable backup exists, the company says the site should be cleaned manually by an experienced security professional or hosting provider. Rank Math specifically advises taking the following steps in order before looking for other suspicious files:
- Delete the entire rank-math-pro plugin folder. Deactivating the plugin is not enough.
- Remove any wp_options entries with the names _uf6qdn2hmm, t8krdk990phb, or _np5pvf754c.
- Block outgoing connections to rank1cdn[.]com if your firewall or hosting tools allow it.
Only after that should administrators inspect the rest of the site and server for signs of compromise.
Indicators of compromise to look for
Rank Math published a list of indicators that may point to an affected site. Their presence should be investigated, but their absence does not guarantee the system is clean.
Network and database clues
- Outgoing connections to rank1cdn[.]com
- Entries in wp_options named _uf6qdn2hmm, t8krdk990phb, or _np5pvf754c
Account and file indicators
- Unknown administrator usernames beginning with wpsupport_
- Unknown administrator accounts using email addresses ending in @wp-mail[.]net
- wp-includes/class-wp-cache-util.php, which Rank Math says is not a legitimate WordPress core file
- Unexpected PHP files in wp-content/mu-plugins/, in other plugins’ folders, or in inc/, includes/, and lib/ folders of non-default themes
- Suspicious PHP code using base64_decode with XOR loops, the key xmmqhn, proc_open, or PHP-FPM socket code
- .htaccess rules that allow .cache files to run as PHP
- .cache files containing PHP code
- System scheduled tasks for the web server user containing the marker #ms6v46
- Unexpected PHP files in the WordPress uploads directory
How to verify cleanup and reduce the risk of reinfection
After cleanup, Rank Math recommends running a full security scan and watching for unusual behavior. It specifically suggests verifying WordPress core files with wp core verify-checksums and checking plugin files with wp plugin verify-checksums –all.
Because checksum tools are not available for every premium plugin, Rank Math says those files should be compared with a clean copy downloaded directly from the developer. Administrators should also monitor outbound connections and confirm that removed files do not reappear. If suspicious files return, the cleanup was not complete.
The company further advises replacing WordPress passwords, database credentials, security keys and salts, payment and email service credentials, API keys, hosting control-panel credentials, and FTP, SFTP, or SSH credentials that may have been exposed. Two-factor authentication settings for administrator accounts should also be reviewed.
Timeline and next steps
Rank Math says the affected window began on October 15, 2026 at 20:02 UTC and ended on October 16, 2026 at 07:12 UTC. On October 16, 2026, it published its security notice and directed affected users to install the clean 3.0.124 release after completing the necessary recovery steps.
For site owners, the most important question is not simply whether version 3.0.123 was ever present, but whether an affected build was downloaded or activated during the vendor-confirmed window. If so, the safest approach is to assume compromise, recover from a clean backup if possible, and rotate all potentially exposed secrets before bringing the site back into production.
Source: Original report
Was this helpful?
Explore more: WordPress Troubleshooting More Cybersecurity Tech News
Last Modified: October 19, 2026 at 10:32 pm
0 views
