Is the free version of Rank Math affected?

No. Rank Math says the free Rank Math SEO plugin from WordPress.org is not affected and no action is needed. Only the paid Rank Math PRO 3.0.123 is affected, and only copies downloaded or delivered as an update between 20:02 UTC on 15 October 2026 and 07:12 UTC on 16 October 2026.

I already updated to 3.0.124. Am I safe?

Not necessarily. The update replaces only the plugin files. Backdoors in other folders, administrator accounts and scheduled tasks created by the malware stay in place. If a 3.0.123 copy from the window was active on your site, Rank Math says to treat the site as compromised, even after the update.

How do I know whether I had the infected copy?

Not from the version number alone: 3.0.123 was released on 7 October, and copies installed before 20:02 UTC on 15 October are clean. What matters is when the update was installed. Check the modification date of the rank-math-pro folder over FTP or in your file manager, an activity log plugin, your host’s backups and any email from Rank Math. Then check the signs of compromise listed in this article.

Is deactivating the plugin enough?

No. Rank Math says deactivating the plugin alone is not sufficient. Delete the whole rank-math-pro folder, remove the three wp_options entries, and then install 3.0.124 after logging in to your Rank Math account directly.

What data could the attackers have?

Anything the web server can read: WordPress passwords, the database credentials in wp-config.php, API keys for payment and email providers, and, depending on the site, customer and order data. Rank Math recommends changing all of these credentials.

Does the free Zybee PHP check detect this backdoor?

No. Our PHP check only shows which PHP version your site reports from the outside. Whether Rank Math PRO 3.0.123 left malware behind can only be seen in your site’s files and database. The checks are listed in this article.

Rank Math PRO backdoor: check and clean your site

If you use Rank Math PRO and updated it between 20:02 UTC on 15 October 2026 and 07:12 UTC on 16 October 2026, your WordPress site may be running malware. Rank Math PRO 3.0.123 was distributed with a backdoor through the vendor’s own download and update channel. Rank Math confirmed this on 16 October.

The catch: updating to 3.0.124 does not remove the backdoor. The malware copies itself to other folders, creates administrator accounts and sets up scheduled tasks. This article shows whether you are affected, what to check and how to clean the site.

The short version

Affected: only Rank Math PRO 3.0.123, downloaded or updated between 20:02 UTC on 15 October and 07:12 UTC on 16 October 2026. The free version from WordPress.org is not affected.

If that copy was activated: treat the site as compromised, even if it now runs 3.0.124.

Stop reinfection first: delete the whole rank-math-pro folder (deactivating is not enough), delete three wp_options entries, block connections to rank1cdn.com.

Then find and clean: unknown admins (wpsupport_…), the file wp-includes/class-wp-cache-util.php, PHP inside .cache files, cron jobs tagged #ms6v46.

Change every credential: WordPress, database, security keys, API keys, hosting, FTP and SSH.

No time or no developer? We clean up your site, with a quote before we start.

Rank Math PRO 3.0.123: what happened?

Rank Math is one of the most widely used SEO plugins for WordPress. The free version has more than 4 million active installations on WordPress.org. How many sites use the paid PRO version is not known.

According to Rank Math’s security notice, copies of Rank Math PRO 3.0.123 downloaded from rankmath.com or delivered as updates between 20:02 UTC on 15 October 2026 and 07:12 UTC on 16 October 2026 contained malware. That is a window of about eleven hours. Wordfence tracks the incident as CVE-2026-111862 and rates it critical (CVSS 9.8 out of 10); Patchstack classifies it as a backdoor. The clean version is 3.0.124.

Rank Math has not said how the malware got into its downloads, how many customers received it, or whether automatic updates installed it. Rank Math is part of the Swedish hosting group group.one.

According to The Hacker News, this is at least the third case this year of a premium WordPress plugin shipping a backdoor through its vendor’s official update channel.

Is my site affected?

Rank Math describes three cases:

Your case	What Rank Math says	What to do
3.0.123 from the window installed and activated	Treat the site as compromised	Clean up (below) and change all credentials, even if 3.0.124 is already installed
3.0.123 from the window installed, never activated	Delete the files, install 3.0.124 from your account, run a scan as a precaution	Delete the `rank-math-pro` folder, reinstall cleanly, check for the signs below
3.0.123 only downloaded, never installed	No sign of compromise from this incident alone	Delete the file, download 3.0.124 from your account
Only the free version from WordPress.org	Not affected	Nothing

The version number alone tells you nothing. Rank Math PRO 3.0.123 was released on 7 October. If you installed it before 20:02 UTC on 15 October, your copy is clean. What matters is when the update happened. How to find out:

Email from Rank Math: the vendor wrote to some of the affected customers. Check your spam folder too. Do not click links in such emails; log in at rankmath.com directly. Rank Math says it never sends login or download links by email.
Modification date of the wp-content/plugins/rank-math-pro folder in your host’s file manager or over FTP.
Activity log, if you use a plugin such as WP Activity Log or Simple History.
Your host’s backups: which version is in the backup from 15 October, and which in the one from 16 October?

If you are unsure, check the signs of compromise in the next section. Wordfence warns, though, that finding none of them does not prove the site is clean.

How to detect the Rank Math backdoor

Rank Math and Wordfence list these indicators. The first three are the quickest to check:

Administrator accounts whose username starts with wpsupport_ or whose email address ends in @wp-mail.net. Look under Users → All Users → Administrator.
Three entries in the wp_options table (your table prefix may differ from wp_) with these values in the option_name column: _uf6qdn2hmm, t8krdk990phb, _np5pvf754c. In phpMyAdmin:
```
SELECT option_name FROM wp_options
WHERE option_name IN ('_uf6qdn2hmm', 't8krdk990phb', '_np5pvf754c');
```
The file wp-includes/class-wp-cache-util.php. It is not part of WordPress.
.cache files containing PHP code, and .htaccess rules that run .cache files as PHP.
Suspicious PHP files in wp-content/mu-plugins/, in other plugins’ folders, in the inc/, includes/ and lib/ folders of themes, in Rank Math’s includes/ folder and in wp-content/uploads/. Typical markers are base64_decode combined with XOR loops, the key xmmqhn, and proc_open.
Scheduled tasks: cron jobs of the web server user tagged #ms6v46, and unknown WordPress scheduled events (with WP-CLI: wp cron event list).
Unknown SSH keys in ~/.ssh/authorized_keys, if your hosting allows SSH.
Connections to the domain rank1cdn.com. According to The Hacker News, it was registered on 14 October, a day before the distribution began.

How to remove the Rank Math malware

Safest: restore a backup from before the attack. Rank Math recommends restoring files and database from a backup taken before 20:02 UTC on 15 October 2026. Then run a scan, change all credentials and install 3.0.124 from your Rank Math account. You will need to re-add content and orders created since then.

Without a clean backup, work in this order. The first three steps stop the malware from recreating itself while you clean:

Delete the whole wp-content/plugins/rank-math-pro folder over FTP or in your file manager. Rank Math: “Deactivating the plugin alone is not sufficient.”
Delete the three wp_options entries (names above).
Block outgoing connections to rank1cdn.com if your host or firewall allows it.
Find and remove the other traces: unknown administrators, the fake core file, .htaccess rules, .cache files, cron jobs, SSH keys. Replacing the wp-admin and wp-includes folders with fresh copies is the simplest way to clean the core.
Change every credential (next section).
Reinstall Rank Math PRO 3.0.124, only after logging in at rankmath.com directly.
Verify: run a security scan, plus wp core verify-checksums and wp plugin verify-checksums --all with WP-CLI. No public checksums exist for Rank Math PRO itself. Watch for returning files over the next few days.

If the malware comes back, a backdoor is still in place.

After the Rank Math hack: credentials to change

The malware ran with your site’s permissions. Assume that anything the site could read is known to the attackers. Rank Math lists:

WordPress passwords for all users
Database username and password in wp-config.php
Security keys and salts in wp-config.php (this logs out every user)
API keys: payment providers such as Stripe or PayPal, email delivery (SMTP), other services
Hosting control panel, FTP/SFTP and SSH
Secrets in environment variables
Two-factor authentication for administrators: set it up again

Change them once you have done the first three cleanup steps. While the backdoor is still running, the attackers can read new credentials as soon as you set them.

If personal data was reachable on the site, such as WooCommerce orders, customer accounts or form entries, you may have to report the incident to a data protection authority. Under the GDPR the deadline is 72 hours after you become aware of it. This is not legal advice.

What to take from this

This time the malware did not come through a vulnerability but through the official update channel. Updates alone do not protect you from that. What helps:

Backups with several versions going back at least 30 days, stored outside your web space. Otherwise the last clean copy may already be overwritten when you learn about an incident.
An activity log that records updates, new users and file changes.
Reading the security news of the vendors whose paid plugins you use.
Deleting unused plugins. Every plugin is one more way into your site.

If your site also runs an old PHP version, that is the next open door: check your PHP version for free.

Rather not do this yourself? We check and clean up your site and tell you the price before we start. Ask for help.

Rank Math PRO 3.0.123 backdoor: how to check your WordPress site