What happened
Rank Math is one of the most popular SEO plugins for WordPress, and a lot of local business sites run its paid PRO version. Rank Math says that some copies of PRO 3.0.123 downloaded or updated between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026 (4:02 PM to 3:12 AM Eastern) contained malware. It pulled the files and released 3.0.124 as the clean replacement. Rank Math hasn’t said publicly how the files were altered.
According to Rank Math and the public CVE record, the malware hides a backdoor that rebuilds itself whenever someone visits the site, can create administrator accounts, talks to a domain called rank1cdn.com, and can read anything the web server can: WordPress passwords, the database login, API keys and email (SMTP) credentials.
Who needs to act
Having version 3.0.123 doesn’t by itself mean a site was hit. What matters is when that copy was downloaded and whether it was turned on. Rank Math splits it three ways:
- Installed and activated during the window: treat the site as compromised and follow the cleanup below.
- Installed but never activated: delete the plugin files, install 3.0.124 and run a security scan.
- Downloaded but never installed: no sign of compromise from this incident alone.
Many agencies let premium plugins update themselves. An automatic update that landed in that window counts, even if nobody touched the site.
What to do
- Find out when PRO was updatedCheck the plugin’s version under Plugins in WordPress, and ask whoever manages the site whether it updated on October 15 or 16. Your host’s backups or activity log can show the date too.
- Best option: restore a clean backupRestore from a backup made before 4:02 PM Eastern on October 15, run a security scan, change every password and key, then install PRO 3.0.124.
- If there is no clean backup, clean it by handDelete the whole Rank Math PRO folder (Rank Math is clear that deactivating it isn’t enough), remove the three bad database entries listed below, check for the files and accounts in the next section, and reinstall WordPress core, plugins and themes from official sources.
- Change every credential, either wayWordPress passwords, the database password and security keys in wp-config.php, API and SMTP keys, and your hosting, FTP and SSH logins. Rank Math calls this essential even after restoring a backup, because the malware may already have sent them out.
- Download 3.0.124 only from rankmath.comLog in at rankmath.com yourself. Rank Math says it will never email download or login links, so an email offering “the fixed version” is a scam.
Signs of infection
From Rank Math’s incident notice. Any one of these on your site means it was hit:
- Database entries in wp_options named _uf6qdn2hmm, t8krdk990phb or _np5pvf754c
- A file at wp-includes/class-wp-cache-util.php (not part of WordPress)
- Administrator accounts whose username starts with wpsupport_ or whose email ends in @wp-mail.net
- Server cron jobs tagged #ms6v46, PHP code inside .cache files, or .htaccess rules that let .cache files run
- Outgoing connections to rank1cdn.com, or PHP files in the uploads or mu-plugins folders that nobody put there
If you find any of these and want help, our incident response team does exactly this kind of cleanup, and we can check whether a site is still sending anything out afterward.
Sources
Written by Nikita Huttenlocher, founder and lead engineer at Huttenlocher Technologies, a cybersecurity and software firm in Myrtle Beach, South Carolina. This is general guidance, not a review of your systems.