Rank Math PRO WordPress plugin shipped a booby-trapped update for eleven hours

On October 15 at 8:02 p.m. UTC, Rank Math PRO began distributing version 3.0.123 to customers of this WordPress SEO plugin. Some copies contained malware. Distribution lasted until October 16 at 7:12 a.m. UTC, or from 10:02 p.m. to 9:12 a.m. Paris time. The vendor published a security advisory on October 16, and Wordfence issued an alert on the 17th.

Rank Math is widely used: its free version has more than 4 million active installations, according to WordPress.org. The vendor's advisory covers only the paid PRO version. The vendor mentions a “limited number of users,” without giving a figure, and does not explain how the malicious code got into its package.

What the hidden code does

Wordfence logged the incident under the reference CVE-2026-111862 (score of 9.8 out of 10). According to Wordfence, the program could install itself persistently on the site and communicate with the domain rank1cdn[.]com. It can recreate a hidden backdoor each time the site is visited. It could also expose WordPress passwords, database credentials, API keys and any other secrets readable by the server.

Rank Math removed the files and released a clean version, 3.0.124. But updating is not enough: it does not delete the files, accounts or scheduled tasks the program may have created elsewhere.

Is your site affected?

The version number alone proves nothing: only copies downloaded during those eleven hours are affected. The vendor distinguishes three cases.

• Plugin installed and activated during that period: the site must be treated as compromised.
• Installed but never activated: delete the files, install 3.0.124 and run a security scan.
• Only downloaded: according to Rank Math, there is no sign of compromise.

Cleaning up without leaving the door open

The best solution is to restore the site and database from a backup made before October 15, 8:02 p.m. UTC. Otherwise, follow the steps in order, because the program reinstalls itself whenever a page is visited:

1. delete the entire rank-math-pro folder (deactivating it is not enough);
2. delete the entries _uf6qdn2hmm, t8krdk990phb and _np5pvf754c from the wp_options table;
3. if possible, block outgoing connections to rank1cdn[.]com.

Then look for the other traces reported by the vendor. First, unknown administrator accounts whose name starts with wpsupport_ or whose address ends with @wp-mail[.]net. Next, the fake file wp-includes/class-wp-cache-util.php and .cache files containing PHP. Finally, .htaccess rules that make those files executable, and scheduled tasks tagged #ms6v46. Once the site is clean, change all secrets: passwords, database credentials, WordPress keys and salts, API keys, and SMTP, FTP, SFTP and SSH access.

Rank Math states that it will never send a login or download link by email: any such message would be phishing. In the case of the Bricksforge plugin vulnerability, a WordPress plugin already left sites exposed. This time, the update itself was the danger. It remains to be seen how the package was modified: the vendor promises to strengthen its safeguards, without detailing the cause.