Rank Math PRO Joined a 2026 Pattern of Paid Plugin Backdoors

Copies of Rank Math PRO 3.0.123 pulled from rankmath.com between 20:02 UTC on October 15, 2026, and 07:12 UTC on October 16 contained malware, the vendor said. Any site that installed and activated one of those copies should be treated as compromised. Installing clean 3.0.124 replaces the plugin folder and leaves the rest of the server as it is.

The version string is the same one Rank Math dated October 7, eight days before the window opened. That trap has already shown up this year on other paid WordPress plugins that update from the vendor’s own servers, not from WordPress.org.

Official Rank Math Updates Carried Malware for 11 Hours

Rank Math said a limited number of users who downloaded or updated to PRO v3.0.123 in that window received plugin files that “contained malware that could compromise your website if the plugin was activated.” The company pulled the bad files and shipped 3.0.124 the same day it closed the window. It has not said how many customers sat in the limited set, whether every automatic update in the window was dirty, or what hashes mark a clean zip against a bad one.

The span is 11 hours 10 minutes. Wordfence logged the incident as CVE-2026-111862, scored it 9.8, and listed the researcher as unknown. Rank Math, which joined the Swedish group.one in 2023, told owners the backdoor can rebuild itself when someone visits the site.

THE DOWNLOAD WINDOW

1. October 7, 2026: Rank Math dates PRO 3.0.123 in its changelog, with two CSV bug fixes and no security note.
2. October 14, 2026, 19:31 UTC: rank1cdn.com is registered, the domain Rank Math later tells owners to block.
3. October 15, 2026, 20:02 UTC: the affected download and update period begins on rankmath.com.
4. October 16, 2026, 07:12 UTC: the period ends; Rank Math releases 3.0.124 and publishes recovery steps later that day.

A security scanner that watches plugin files on disk still trusts the next official zip. When the zip itself is the payload, that check fires after the site has already run the code.

Version 3.0.123 Does Not Prove a Site Was Hit

Rank Math limits the incident to copies downloaded or installed through an update during the window. A 3.0.123 package obtained before 20:02 UTC on October 15 sits outside it. Wordfence repeated that point: version 3.0.123 by itself does not prove a website was compromised. Owners who only read the number in Plugins, and who never logged when the file arrived, cannot settle the question from the dashboard.

The vendor’s Rank Math PRO 3.0.123 security incident notice sorts sites into three cases. Rank Math also said it has records of who downloaded an affected copy and has emailed some of those users. Anyone who got that mail is told to follow the recovery steps even if the site now shows 3.0.124.

THREE CASES RANK MATH DRAWS

• Installed and activated: Treat the site as compromised, even after a later bump to 3.0.124, and run the full recovery.
• Installed, never activated: Delete the plugin files, install 3.0.124 from the Rank Math account, and run a security scan.
• Downloaded only: Rank Math says this incident alone does not show the site was compromised; support can help if the owner is unsure what ran.

The paid add-on lives in a rank-math-pro folder and arrives from rankmath.com. It is a different package from the free Rank Math SEO plugin on WordPress.org, which the company says is not affected. The directory page states that over 4 million WordPress websites trust Rank Math, and the current free zip is 1.0.280. Those sites are not in this window unless they also run PRO from Rank Math’s own channel.

Paid Plugin Update Servers Repeated the Same Trick

This is at least the third time in 2026 that a premium WordPress plugin’s vendor-run update channel has handed customers a backdoored build. The free copies on WordPress.org stayed out of each of these cases. Paying customers who used the official updater were the ones who got the bad file.

In April, Nextend’s update system served a malicious Smart Slider 3 Pro for WordPress release numbered 3.5.1.35. The vendor said unauthorized parties put that build out on April 7, 2026, and that the update infrastructure was then shut down. Public write-ups of that incident put the live window at about six hours. The clean replacement was 3.5.1.36. Nextend told owners that only the Pro edition was affected, and that any site that ran 3.5.1.35 should be treated as fully compromised.

In June, ShapedPlugin’s Pro plugins were backdoored in the vendor’s Easy Digital Downloads update channel. Real Testimonials Pro is the clearest copy of the Rank Math trap: ShapedPlugin said 3.2.5 released on May 23, 2026, was clean, then the 3.2.5 file was tampered with and served from June 12 to June 16 under the same version number. Clean 3.2.6 followed. Wordfence said it downloaded a still-backdoored 3.2.5 from the official endpoint on June 12. Product Slider Pro and Smart Post Show Pro were named in the same incident. Attackers also altered scripts from Awesome Motive’s CDN in June and poisoned BdThemes’ API feed in August. Nothing published ties those operators to Rank Math.

PAID WORDPRESS PLUGIN BACKDOORS IN 2026

Rank Math’s own changelog makes the trap harder to see in a plugin list. The 3.0.124 notes repeat the same two bug fixes that 3.0.123 listed on October 7, one for CSV import of SEO meta and one for AI Link Genius exports. There is no security line. A site that auto-updated overnight can show 3.0.124 and still have been owned the night before.

What the Backdoor Plants on a Live Site

Rank Math says the malware can recreate a hidden backdoor whenever someone visits the website, which is why deleting odd files first can fail. The attacker may have left PHP backdoors in other plugins, in theme folders, and in must-use plugins, created administrator accounts, dropped a fake WordPress core file, changed.htaccess so.cache files run as PHP, and added scheduled tasks and SSH keys. Any password, database secret, or API key the site could reach should be treated as exposed.

Simply updating the plugin is not enough because the malware may have placed additional files, administrator accounts, or scheduled tasks elsewhere on the server.

Alex Thomas, Wordfence, October 16, 2026 advisory

Wordfence also warned that the listed clues are for investigation. “Their absence does not, by itself, prove that a website is clean.”

SIGNS RANK MATH TELLS OWNERS TO HUNT

• Network: Outbound connections to rank1cdn.com.
• Database: wp_options rows named _uf6qdn2hmm, t8krdk990phb, or _np5pvf754c.
• Accounts: Administrators whose usernames start with wpsupport_, or whose email ends in wp-mail.net.
• Fake core file: wp-includes/class-wp-cache-util.php, which Rank Math says is not a WordPress core file.
• Code traits: PHP that mixes base64_decode with XOR loops, the key xmmqhn, proc_open, or PHP-FPM socket code.
• Server:.htaccess rules that run.cache files as PHP, crontab lines tagged #ms6v46, extra SSH authorized_keys, and PHP inside uploads.

Deactivating Rank Math PRO in the dashboard does not finish the job. Rank Math said the entire rank-math-pro folder has to go, and that “Deactivating the plugin alone is not sufficient.” The fake cache-util file sits under wp-includes, so it survives a plugin toggle and can be rewritten on the next visit if the rebuild logic is still live.

Restore From Before 20:02 UTC, Then Rotate Secrets

Rank Math’s preferred recovery is a restore. If a backup of the site and database from before 20:02 UTC on October 15 exists, restore it, run a security scan, change every password and key, and only then install 3.0.124 from a Rank Math account. The notice also prints the cutoff as 22:02 CEST, 16:02 EDT, and 01:32 IST on October 16, so a host panel that stores local time is not a reason to guess.

Where no clean backup exists, the manual cleanup has a fixed order, and three actions come before any other hunt. Rank Math tells owners who are not comfortable with files, databases, and server settings to ask the host or a security professional to do the work.

STOP THE REBUILD FIRST

1. Delete the folder: Remove the entire rank-math-pro directory with the host file manager or FTP, not by clicking Deactivate.
2. Purge the options: In wp_options, delete any row whose option_name is _uf6qdn2hmm, t8krdk990phb, or _np5pvf754c.
3. Block the beacon: Cut outgoing connections to rank1cdn.com if the host or firewall can do it.

Only after those three steps should anyone search mu-plugins, other plugin folders, the inc, includes, and lib folders of non-default themes, Rank Math’s own includes folder, and uploads. Rank Math also wants a pass over SSH authorized_keys, other users’ crontabs, running processes, and any path outside the site where the web server can write. Shared-hosting customers who cannot see those layers need the host to look.

Credentials change in every case, including after a restore. The list covers WordPress passwords, the database user and password in wp-config.php, the security keys and salts in the same file, payment, SMTP, and other API keys, hosting-panel and FTP, SFTP, or SSH access, secrets in environment variables, and two-factor settings for administrators. The cleanup then wants a full scan, wp core verify-checksums, and wp plugin verify-checksums --all, with the caution that checksums may not exist for premium plugins. 3.0.124 goes on last, downloaded by logging in at rankmath.com directly. Rank Math said some customers may be unable to log in and may need to reset the account password, and that it will never send login or download links by email.

WordPress.org Checksums Never Covered the Paid Plugin

11 hours 10 minutes: Length of the Rank Math PRO download and update window.

9.8: Wordfence CVSS score on CVE-2026-111862, CWE-506 embedded malicious code.

3.0.124: Clean paid build; it does not scrub accounts, crons, or extra PHP the malware already wrote.

Over 4 million: Sites WordPress.org associates with the free plugin, which Rank Math says is not in this incident.

WordPress.org can publish checksums for the free plugin because that code ships through the directory. Rank Math’s notice says checksum verification may not be available for every plugin, “particularly premium plugins,” and tells owners to compare those files with a clean copy from the official source. PRO never had that public file list, which is why a tampered 3.0.123 and a clean 3.0.123 can wear the same badge until someone compares bytes against a known-good zip Rank Math still has not hashed in public.

Patchstack files the case as a backdoor. A firewall rule that watches for a plugin bug does not apply when the vendor’s own package is the dropper. The useful control is the same one Smart Slider and ShapedPlugin customers were told to use: treat the official updater as the path that failed, restore from before the window, and rotate every secret the web server could read.

Rank Math Has Not Named a Customer Count

WHAT WE KNOW

• The path: rankmath.com downloads and updates of PRO 3.0.123 inside the stated window carried malware if the plugin was then activated.
• The clean zip: 3.0.124 is the replacement Rank Math tells customers to install after recovery, from a direct login, not from an emailed link.
• The parent: Rank Math is a group.one brand; the 2023 announcement put it beside WP Rocket and Imagify in that WordPress stack.

WHAT IS UNCONFIRMED

• How it entered: Rank Math has not said how the malicious files got into the download and update system.
• How many zips: “Limited number of users” is the only size the company has given, even though it says it can identify who downloaded an affected copy.
• Package hashes: No SHA values have been published for a known-bad 3.0.123 or for 3.0.124, so a file kept on disk cannot be matched in public.

The only forward line in the notice is that the team is taking steps to reduce the risk of similar incidents. Until Rank Math publishes hashes and a count, a site owner who skipped the email still has to reconstruct whether 3.0.123 arrived during those 11 hours 10 minutes, and a host that still has the zip cannot prove which build it is. 3.0.124 is the current paid file. It is not a clean bill for a site that ran a copy from the window.