Rank Math PRO version 3.0.123, offered for download from the vendor’s own website, contained malware that could plant hidden backdoors on WordPress sites. The build was available for about 11 hours, from 20:02 UTC on Oct. 15 to 07:12 UTC on Oct. 16, 2026, before Rank Math pulled it and released a clean version, 3.0.124. Rank Math says a limited number of users were affected, and it has not said how many.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
The 11-hour download window
Rank Math’s advisory says the free Rank Math SEO plugin on WordPress.org was not part of the compromise, and only the PRO build was tampered with. The free plugin is active on more than 4 million websites, so the exposure is confined to customers who downloaded the paid version during the window rather than the wider installed base. The compromised release is identified as 3.0.123, which makes the version string a starting check, though updating to 3.0.124 does not clear a site that ran the bad build earlier.
BleepingComputer, in an Oct. 19 report by Bill Toulas, said it asked Rank Math for the number of affected sites and the initial attack vector and had received no reply when it published. Rank Math’s own security incident advisory says the affected plugin files contained malware that could compromise a website if the plugin was activated, and that the company “immediately removed the affected files and released a clean version, Rank Math PRO v3.0.124.” The advisory does not explain how the malicious code got into the release, name an attacker or list confirmed data theft. Its guidance splits users into three groups: those who activated version 3.0.123 during the window, those who only installed it, and those who only downloaded it.
Backdoor behavior and indicators
According to Rank Math, the malware establishes persistent access, communicates with the domain rank1cdn.com, exposes database credentials, API keys and other secrets the web server can reach, and recreates its hidden backdoors whenever someone visits the infected site. That last behavior is why simply removing files is not enough. The advisory lists indicators for administrators to look for: database options including _np5pvf754c, a fake core file at wp-includes/class-wp-cache-util.php, administrator accounts whose usernames start with wpsupport_, crontab entries tagged #ms6v46, and rules in the .htaccess file that let .cache files run as PHP. It also points administrators to PHP files in the uploads folder, suspicious files in mu-plugins, and possible changes to SSH authorized_keys and other system crontabs, which means cleanup can extend beyond WordPress itself to the server.
Wordfence also published an advisory on the incident, which BleepingComputer cites. The outlet separately found a PHP sample on VirusTotal that shares those indicators, including the XOR key xmmqhn and the database entry _np5pvf754c, and that appears to act as a first-stage script creating the backdoor file. BleepingComputer reports the sample can run commands, modify WordPress databases and steal AWS, Cloudflare, Google Cloud and Azure credentials and SSH keys, but it could not confirm that the sample was distributed through the compromised plugin.
Cleanup: updating is not enough
The central warning from both Rank Math and BleepingComputer is that deactivating or updating the plugin does not remove the threat. A site on which version 3.0.123 was activated should be treated as compromised. The free edition, which Rank Math says was not affected, is listed separately on WordPress.org.
Rank Math recommends restoring from a clean backup taken before 20:02 UTC on Oct. 15, scanning the restored site and database, rotating every password, key and salt, and only then installing 3.0.124. Without a clean backup, the advisory prescribes a manual order of work: delete the entire rank-math-pro folder, remove the malicious database options and block outbound connections to rank1cdn.com first, then check for additional backdoors, running the WP-CLI commands wp core verify-checksums and wp user list –role=administrator to spot altered core files and rogue administrators, unauthorized administrator accounts, altered files, scheduled tasks and changes outside WordPress. Credentials come next, covering hosting, database, SMTP and SSH access as well as API keys.
Sites where the plugin was installed but never activated need less: delete it, download 3.0.124 and scan. Rank Math says it will never send login or download links by email, and that the clean build should be fetched only from rankmath.com while logged in. The company also reported that free accounts registered between Oct. 13 and Oct. 16 were removed during a system refresh, and those users must recreate an account and reconnect their site from the dashboard’s Help tab before features such as Rank Tracker and the AI tools work again.
Open questions remain. Rank Math has not said how the malicious files reached its download system or how many sites installed them, and it has not named who is responsible. Site owners who cannot establish whether they activated version 3.0.123 between the Oct. 15 and Oct. 16 timestamps are left to check their own plugin history, and the advisory says they can contact Rank Math support if unsure. The Wordfence and VirusTotal pages are the pointers BleepingComputer gave for further technical detail.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
- The NSA says three phone features should be off whenever you aren’t using them
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
- Tropical Storm Rachel is dumping up to 12 inches on four Mexican states on its way to major hurricane strength
