TL;DR
- what: Rank Math PRO copies served from rankmath.com, by direct download and by update, between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware that installs a self-restoring backdoor.
- impact: Any site that installed and activated an affected copy should be treated as fully compromised: it may have rogue administrator accounts, extra PHP backdoors, cron and SSH persistence, and every reachable secret may be exposed.
- fix: Rank Math removed the malicious files and released 3.0.124, tracked as CVE-2026-111862, but the update does not clean up files, accounts or scheduled tasks the malware already created, so the vendor recommends restoring from a backup taken before the window and rotating every credential.
- who: WordPress sites running the paid Rank Math PRO plugin that pulled 3.0.123 from rankmath.com during the window; the free WordPress.org plugin with more than 4 million installs is not named in the notice.
For 11 hours and 10 minutes, the official distribution channel for Rank Math PRO, the paid version of one of the most widely used SEO plugins for WordPress, delivered malware. Rank Math said in a security notice on October 16 that copies downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 were malicious. Any site that installed and activated one of those copies should be treated as compromised. The malware plants a hidden backdoor that rebuilds itself whenever someone visits the site.
Wordfence assigned the incident CVE-2026-111862 and scored it 9.8 out of 10. Patchstack classifies it as a backdoor and notes that because the attack happened on Rank Math's own systems, "a rule is not possible for mitigation." No virtual patch or WAF signature stops a payload that arrives through the vendor's signed update path.
Why the Version Number Does Not Tell You If You Are Affected
The malicious copies carried version 3.0.123, but that version number alone does not mean a site is infected. Rank Math's changelog dates 3.0.123 to October 7, more than a week before the window opened. A copy of 3.0.123 obtained before 20:02 UTC on October 15 is clean. What matters is when the file was pulled, not the version string it reports.
Rank Math's notice sorts sites into three cases:
- Installed and activated during the window: treat the site as compromised, even if it has since moved to 3.0.124.
- Installed but never activated: Rank Math advises removing the plugin files, installing 3.0.124 from the customer account and scanning the site.
- Downloaded but never installed or activated: nothing in this incident alone indicates compromise.
The notice covers only the PRO plugin, which customers get from rankmath.com rather than WordPress.org. The free Rank Math SEO plugin on WordPress.org, with more than 4 million active installations and a last update on October 6, is not named. Rank Math has emailed some affected users.
⚠️ Updating is not remediation — Installing 3.0.124 replaces the plugin folder. Wordfence's October 17 advisory says it does not remove files, administrator accounts or scheduled tasks the malware may already have placed elsewhere on the server. Rank Math also states that deactivating the plugin alone is not enough. A site that ran the malicious build and was simply updated is still compromised.
What the Malware Does
Everything known about the payload comes from Rank Math's notice. Neither Rank Math nor Wordfence has published a code analysis, and neither names an attacker. The notice describes a backdoor that is rebuilt by code triggered on site visits, so removing visible files while the rebuild trigger stays active may not fix anything. According to Rank Math, the attacker may also have:
- Dropped PHP backdoors into other plugins' folders, theme folders, the must-use plugins directory and uploads.
- Created administrator accounts with usernames beginning wpsupport_ or email addresses ending in @wp-mail[.]net.
- Added a fake core file, wp-includes/class-wp-cache-util.php, which is not part of WordPress.
- Modified .htaccess so .cache files run as PHP, and planted .cache files containing PHP code.
- Added WordPress scheduled events, crontab entries tagged #ms6v46, and SSH authorized_keys entries.
- Communicated with the domain rank1cdn[.]com.
Rank Math also lists code traits: PHP using base64_decode with XOR loops, the key xmmqhn, proc_open calls, and PHP-FPM socket code. Three wp_options entries are tied to the malware: _uf6qdn2hmm, t8krdk990phb and _np5pvf754c. proc_open and PHP-FPM socket access mean the payload can run commands at the OS level, which is why the vendor tells owners to check crontabs for other users, running processes and any writable location outside the web root.
Indicators of Compromise
- Network: rank1cdn[.]com
- Database: wp_options rows _uf6qdn2hmm, t8krdk990phb, _np5pvf754c
- File: wp-includes/class-wp-cache-util.php
- Accounts: wpsupport_* administrators, @wp-mail[.]net addresses
- Persistence: crontab tag #ms6v46, .htaccess rules executing .cache as PHP, new SSH authorized_keys
- Code: XOR key xmmqhn, base64_decode with XOR loops, proc_open
Wordfence adds a caveat: "Their absence does not, by itself, prove that a website is clean." These are the indicators that have been published so far, not a full list.
Credential Exposure Is the Bigger Problem
Rank Math says owners should assume any secret the site could reach was exposed. That includes WordPress passwords, the database credentials and the security keys and salts in wp-config.php, payment gateway and SMTP keys, other API keys, hosting panel, FTP, SFTP and SSH access, and secrets stored in environment variables. On WooCommerce or membership sites, payment gateway keys are a direct path to financial fraud. The vendor's guidance requires rotating credentials even after a clean restore, because restoring files does nothing about secrets that have already been stolen.
Vendor Remediation Guidance
Rank Math's preferred path is to restore from a site and database backup taken before 20:02 UTC on October 15, rotate all credentials, and only then install 3.0.124, downloaded by logging in at rankmath.com directly. Without a clean backup, the vendor lays out a manual cleanup in a fixed order: remove the plugin folder, purge the three wp_options entries and block egress to rank1cdn[.]com, and only after that hunt for the other changes. The order matters because of the self-restoring trigger.
Integrity checking has a gap — WordPress.org publishes no checksums for Rank Math PRO. The Hacker News checked the plugin-checksums service on October 19 and found none under either of the plugin's names, though checksums exist for the free plugin. Comparing against a clean copy from rankmath.com is the fallback. Rank Math says it will never send login or download links by email, and some customers may need to reset their account password to log in.
What Rank Math Has Not Disclosed
Rank Math is part of the Swedish hosting group group.one. It has not said how the malicious files got into its download and update system, how many customers received one, or who is responsible. Without a root cause, customers cannot judge whether the vendor's build and release pipeline is now secure. The case follows a familiar pattern: commercial WordPress plugins update outside the WordPress.org review and checksum system, so a compromised vendor server can reach every paying customer with no independent check in between.
RedEye Assessment
This is a full-site compromise delivered through a trusted channel, and it comes with OS-level execution and multiple persistence layers. Organizations running Rank Math PRO need to establish whether they pulled the plugin during the 11-hour window, treat any affected site as breached, and look beyond WordPress to the hosting account, the database and every integration the site touches. If you need help scoping exposure, validating cleanup or rotating credentials across connected systems, contact RedEye Security for an incident assessment.
Originally published on RedEye Threat Intelligence.
Top comments (0)