Rank Math PRO 3.0.123 shipped malware for eleven hours

Rank Math PRO 3.0.123 shipped malware for eleven hours

16 October 2026: Rank Math says copies of its paid WordPress SEO plugin, Rank Math PRO 3.0.123, downloaded between 20:02 UTC on 15 October and 07:12 UTC on 16 October contained malware that compromises a site once the plugin is activated. The company removed the files and released a clean 3.0.124, and tells anyone who activated the bad version to treat the site as compromised.

Not yet independently verified. Rank Math has not said how the attacker reached its build or download system or how many sites took the affected version, and no CVE has been assigned. We will update this when it can be confirmed, and remove this note.

Which sites are affected

Rank Math sorts sites into three cases:

• Installed and activated 3.0.123 in the window: treat the site as compromised and follow the recovery steps.
• Installed but never activated: delete the plugin files, install 3.0.124 from the Rank Math account, and scan.
• Downloaded but never installed: no sign of compromise from this incident alone.

The free Rank Math SEO plugin is not named as affected. Agencies that push plugin updates across many client sites should check each one, because an automatic update during the eleven-hour window would have activated the bad build without anyone touching it.

Restoring or cleaning a site

The recommended route is to restore files and database from a backup taken before 20:02 UTC on 15 October, scan the site, change every password and key, then install 3.0.124. Rank Math warns that the malware can recreate a hidden backdoor on each page visit, so a manual clean-up has to follow its order: first delete the whole rank-math-pro folder (deactivating is not enough), remove the wp_options rows named _uf6qdn2hmm, t8krdk990phb and _np5pvf754c, and block outgoing connections to rank1cdn.com; only then hunt for other changes.

What the attacker leaves behind

The indicators Rank Math lists include a fake wp-includes/class-wp-cache-util.php, .htaccess rules that let .cache files run as PHP, administrator accounts whose usernames start with wpsupport_ or whose email addresses use the wp-mail[.]net domain, a cron entry tagged #ms6v46 in the system crontab, PHP files in uploads/, and code that combines base64_decode with XOR loops keyed on xmmqhn, proc_open and PHP-FPM socket calls.

Because the malware reaches the server level, Rank Math asks owners to rotate more than WordPress passwords: database credentials, security keys and salts, SMTP and payment keys, hosting, FTP, SFTP and SSH logins, environment secrets and administrator two-factor settings, and to check SSH authorized_keys and other users' crontabs.

A warning about follow-up emails

Rank Math says it never sends login or download links by email, which matters because incidents like this tend to be followed by phishing that imitates the vendor's recovery notice. Some customers will need to reset their account password before they can download 3.0.124. Our SEO software category lists 20 products.

Sources

• Rank Math: PRO 3.0.123 security incident, how to secure your website, 16 October 2026
• SecurityWeek: Rank Math Pro WordPress plugin compromised in supply chain attack, 19 October 2026