Rank Math SEO PRO malware requires full site recovery
Rank Math SEO PRO malware was included in some copies of version 3.0.123 obtained between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC, according to Rank Math. Malware is software designed to gain unauthorized access or cause harm. The incident was a supply-chain compromise, meaning malicious code entered software distributed through a trusted provider. Rank Math says any site that activated an affected package should be treated as compromised because the code may have created files, administrator accounts, scheduled tasks or server changes beyond the plugin itself. Updating alone is therefore not a complete remedy.
Wordfence Intelligence assigned the unauthenticated embedded malicious code a 9.8 Critical CVSS rating. CVSS, the Common Vulnerability Scoring System, is a standard scale for describing security severity. The issue is tracked as CVE-2026-111862, a public identifier for a specific security flaw, and Wordfence lists the researcher as unknown. Rank Math removed the affected files and released version 3.0.124 as the clean replacement. However, merely finding version 3.0.123 does not establish compromise. Rank Math limits the incident to packages downloaded or installed during the confirmed window.
The required response depends on what happened. If an affected copy was installed and activated, Rank Math advises a full recovery. If it was installed but never activated, delete the affected plugin files, install version 3.0.124 from the Rank Math account and run a security scan. If the package was downloaded but never installed or activated, Rank Math says this incident alone does not indicate that the website was compromised. Rank Math says it has records of users who obtained affected copies. Anyone it notified should follow the recovery instructions even if the site now runs another version.
For an activated package, the preferred recovery is to restore both the website and its database from a clean backup made before October 15, 2026 at 20:02 UTC. The database is where WordPress stores content, users and settings. After restoration, scan the site, replace every sensitive credential the website could reach, and install version 3.0.124 directly from the account. If no suitable backup exists, Rank Math recommends manual cleaning by an experienced security professional or hosting provider for owners who are not comfortable changing files, database records and server settings.
The order of manual cleanup matters because the malware could recreate a hidden backdoor, which is a concealed way to regain access, whenever somebody visited the site. Rank Math says to delete the entire rank-math-pro folder rather than merely deactivate the plugin. Next, remove any record in the wp_options settings table named _uf6qdn2hmm, t8krdk990phb or _np5pvf754c. Where supported, block outgoing connections to rank1cdn[.]com. Only after disabling that recreation mechanism should responders remove other suspicious material and reinstall WordPress, plugins and themes from trusted copies where appropriate.
Rank Math's indicators of compromise include connections to rank1cdn[.]com, administrator names beginning with wpsupport_, and accounts using addresses ending in @wp-mail[.]net. File indicators include wp-includes/class-wp-cache-util.php, which Rank Math says is not a legitimate WordPress core file, and unexpected PHP files. PHP is the programming language used by WordPress. Suspicious locations include wp-content/mu-plugins/, which holds automatically loaded plugins, folders belonging to other plugins, the inc/, includes/ and lib/ directories of non-default themes, the Rank Math includes/ directory and the uploads directory.
Other warning signs include PHP code using base64_decode with XOR loops, the key xmmqhn, proc_open or PHP-FPM socket code, which communicates with the process that runs PHP. Owners should inspect root and subdirectory .htaccess configuration files for rules that allow .cache files to execute as PHP, and check .cache files for PHP code. System cron tasks, which run automatically on a schedule, are suspicious if they belong to the web server user and contain the marker #ms6v46. Rank Math also recommends reviewing WordPress scheduled events, SSH authorized keys used for remote server access, tasks owned by other system users, running processes and writable locations outside the website directory. Finding none of these signs does not prove that the site is clean.
Credential replacement remains essential even after restoring a backup. Rank Math recommends changing WordPress passwords, database credentials, WordPress security keys and salts, payment and email service credentials, API keys that let software access other services, hosting control-panel logins, and FTP, SFTP or SSH access credentials used for file transfer or remote administration. Administrator accounts and their two-factor authentication settings, which require a second login check, should also be reviewed. The warning covers every secret that may have been accessible to the compromised web server, not only the WordPress password.
After cleanup, run a full scan and verify WordPress core files with `wp core verify-checksums`. A checksum is a digital fingerprint used to detect a changed file. Check plugin files with `wp plugin verify-checksums --all`; because checksums are unavailable for every premium plugin, compare unsupported products with a clean copy downloaded directly from the developer. Continue monitoring outgoing connections and watch whether deleted files return. Reappearing files mean the cleanup is incomplete.
Rank Math says version 3.0.124 should be obtained by navigating directly to rankmath.com and signing in. It says it will not email login or download links, so unexpected messages containing such links should be considered suspicious. The affected period ended at 07:12 UTC on October 16, and Rank Math published its security notice that day. Its notice remains the authoritative place for incident updates. Wordfence says Care and Response customers can contact its incident-response team for investigation and cleanup assistance.
For readers seeking protection at the hosting layer, AEU Hosting provides managed WordPress hosting secured end to end. Regardless of provider, owners of an affected site should preserve evidence, use a pre-incident backup where possible, replace exposed secrets, install the clean release and keep monitoring for renewed access.