Rank Math PRO Backdoor: Check and Clean Your Site

Copies of Rank Math PRO 3.0.123 downloaded from the Rank Math website or delivered as updates on October 15–16, 2026 contained malware. Rank Math says any site that installed and activated an affected copy should be treated as compromised. The safest path is to restore a backup from before the incident, replace every password and key, and then install the clean 3.0.124. Sites that only run the free Rank Math SEO plugin from WordPress.org are not affected. Below is how to tell whether you are affected, how to clean up in the right order if you have no backup, and how to confirm the site is clean afterward.

Compiled from Rank Math's official notice and reporting by Wordfence, Patchstack and security news outlets, as of October 29, 2026. For the exact steps and scope, Rank Math's notice is the reference.

What happened

Rank Math is an SEO plugin used on a large number of WordPress sites, with a free version and a paid PRO version. On October 16, Rank Math published a security notice: copies of Rank Math PRO 3.0.123 downloaded from rankmath.com or delivered through updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware. Rank Math removed the affected files and released a clean version, 3.0.124.

Wordfence classifies it as a supply-chain compromise, tracked as CVE-2026-111862 with a severity of 9.8 out of 10. According to Wordfence and Rank Math, the malware can keep persistent access, contact rank1cdn.com, recreate hidden backdoors whenever someone visits the site, and expose WordPress credentials, database credentials, API keys and other secrets the web server can read. A related sample analyzed by BleepingComputer also creates administrator accounts whose usernames start with wpsupport_.

What makes this one awkward is that the usual defense against plugin vulnerabilities is to stay up to date, and here the official update itself was the problem. Patchstack notes that because the attack hit Rank Math's own download and update system, a firewall rule cannot block it. As of the published reports, Rank Math has not said how the malicious files got into its system or how many customers received them.

First, work out whether you are affected

Wordfence warns that the version number alone does not tell you whether your copy is a tainted one, and Rank Math says that having 3.0.123 does not by itself mean a site was hacked. What matters is whether you downloaded or updated the PRO plugin during that window, and whether it was activated. Rank Math says it has records of who downloaded an affected copy; if you received a notice from Rank Math, follow it even if your site now runs a different version.

If you are not sure, think back to whether the site updated Rank Math PRO on October 15–16. If you cannot tell, handling it as installed and activated is the safer call.

Option 1: restore a backup from before the incident (recommended)

If you have a full site and database backup from before 20:02 UTC on October 15, restore it. Then scan the site with a reputable tool such as Wordfence or Sucuri, change every password, database credential and API key, and only then install the clean 3.0.124 from your Rank Math account.

Keep in mind that restoring overwrites anything added after the backup. If the site takes orders, registrations or comments, export or note down everything since October 15 before you restore, and add it back afterward. If your backups live with your host, ask how far back they go; some hosts only keep the last few days.

Option 2: no backup, so clean it by hand in order

Rank Math stresses that the order matters, because the malware rebuilds its backdoor whenever someone visits the site. Do it out of order and what you delete comes right back.

1. Stop it from rebuilding itself. Delete the entire rank-math-pro folder with your host's file manager or FTP; deactivating the plugin is not enough. In the wp_options table, delete the entries whose option_name is _uf6qdn2hmm or t8krdk990phb. If your host or firewall allows it, block outgoing connections to rank1cdn.com.
2. Look for everything else the attacker left. That includes hidden PHP backdoors in mu-plugins and in other plugin and theme folders; unknown administrators whose usernames start with wpsupport_ or whose email ends in @wp-mail.net; the fake core file wp-includes/class-wp-cache-util.php, which you should remove before checking core files with wp core verify-checksums; .htaccess rules that let .cache files run as PHP; scheduled tasks tagged #ms6v46; and PHP files in the uploads folder. Outside WordPress, check SSH authorized keys, other users' crontabs and running processes.
3. Replace every credential. WordPress and other site passwords, the database user and password in wp-config.php, WordPress security keys and salts, payment, email and API keys, and your hosting panel, FTP and SSH logins. Turn on two-factor authentication for administrators while you are at it. This step applies even if you restored a backup.
4. Confirm the site is actually clean. Run another security scan, verify core and plugin checksums, and over the next few days watch for outgoing connections to unfamiliar addresses and for deleted files reappearing.

Wordfence also points out that updating straight to 3.0.124 only replaces Rank Math's own files. Files, accounts and scheduled tasks the malware placed elsewhere stay where they are. Updating without cleaning leaves the backdoor in place.

When you cannot clean it yourself

A manual cleanup means working in the database and checking the server's scheduled tasks and SSH keys, which is not easy if you do not manage servers, and missing a single backdoor lets it grow back. If the site takes payments or stores member data, hand the steps above to a malware-cleanup service or a developer who knows WordPress well. If the site is on shared hosting, ask your host whether they have a backup from before the incident; restoring is usually much faster than cleaning by hand.

Habits worth changing after this

The people who got out of this fastest were the ones who happened to have a backup from before the incident. Having backups is not enough on its own; they need to go back far enough. Problems like this are often noticed days later, and if you only keep two or three days of backups, the clean copy may already be gone by the time you find out.

Treat paid plugin updates with the same care as any other. For important sites, update a staging copy first and give it a day or two, or at least take a backup right before updating; our guide to updating plugins safely walks through it. Delete plugins you do not use: every plugin you remove is one less thing that can go wrong. Other WordPress and PHP security news from this month is collected in our October WordPress vulnerability roundup and the PHP October emergency update guide.

If you would rather not look after backups and updates yourself

When you run your own server, incidents like this mean you judge the risk, restore and clean up yourself. If you would rather hand the server side to someone else, managed WordPress is worth a look. RoamerHost runs each WordPress site in its own container. Both plans include automatic backups that the platform keeps for the whole site, with nothing for you to set up, and if the site breaks badly or you cannot get into the dashboard, support helps you restore. WordPress security updates (minor versions) are applied automatically, and you can install any plugins and themes you like, so paid plugins such as Rank Math PRO work as usual. That also means that if a plugin itself is compromised, you still follow the plugin vendor's instructions.

WordPress Basic is NT$3,588 a year (avg. NT$299/mo, billed yearly). With WP × Roamer AI Pro (NT$11,988 a year, avg. NT$999/mo, billed yearly), you can also ask Roamer AI to read the error log, deactivate a problem plugin or roll back to a snapshot, and higher-risk actions ask you for a confirmation code first. RoamerHost is run by a team in Taiwan with support in Traditional Chinese. Plan details are on the WP × Roamer AI page, and if your site is already down, start with our white-screen rescue guide.

FAQ

Q: I use the free Rank Math SEO plugin. Do I need to do anything?

No. Rank Math's notice says the free plugin from WordPress.org is not affected by this incident. Separately, when Rank Math reset its systems it removed free accounts registered between October 13 and October 16, so if you signed up during that time and cannot find your account, that is why.

Q: Is updating to 3.0.124 enough?

No. 3.0.124 only replaces Rank Math's own files; backdoors, administrator accounts and scheduled tasks the malware created elsewhere remain. If an affected copy was installed and activated, restore a backup as in option 1 or clean up in the order shown in option 2, and replace every credential.

Q: My plugin shows version 3.0.123. Does that mean my site was hacked?

Not necessarily. Rank Math says having 3.0.123 does not by itself mean a site was compromised. The problem copies are the ones downloaded or updated between 20:02 UTC on October 15 and 07:12 UTC on October 16, and the version number does not tell you which copy you have. If you cannot tell, handle it as installed and activated, or check whether Rank Math sent you a notice.

Q: I already restored a backup. Do I still need to change passwords?

Yes. The malware may already have sent out credentials and keys the web server could read. Restoring rolls back the site's content, but leaked credentials still work. In Rank Math's steps, replacing every credential is required after a restore.

Sources

• Rank Math: Rank Math PRO 3.0.123 Security Incident: How to Secure Your Website, PRO changelog
• Wordfence: Rank Math SEO PRO vulnerability records
• Patchstack: Rank Math SEO PRO 3.0.123 embedded malicious code
• BleepingComputer: WordPress SEO plugin Rank Math compromised to backdoor websites
• The Hacker News: Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor
• SecurityWeek: Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack
• RoamerHost: WP × Roamer AI plans and FAQ