Published October 21, 2026. Based on public reports available on that date; details may change.

Some copies of Rank Math PRO 3.0.123 downloaded between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC contained malware, according to Rank Math. If your site activated that build, treat the site as compromised: restore a backup from before the window or clean it manually, rotate every credential, and then install the clean 3.0.124. The free Rank Math plugin was not affected.

What happened

Rank Math, a widely used WordPress SEO plugin, reported that the PRO 3.0.123 package served during a window of about eleven hours contained malicious code. The story was reported publicly on October 20, 2026. Rank Math says the malware could compromise a site if the plugin was activated, and that it installs a hidden backdoor that can recreate itself when someone visits the site. Rank Math has released 3.0.124 as the clean version. It has not said publicly how the malicious code got into the package.

This is a supply-chain incident: the site owner did nothing wrong. A trusted update was the delivery method, which is why the cleanup matters more than the update.

Who is affected

Rank Math splits sites into three groups:

  • Activated 3.0.123 from the window: treat the site as compromised.
  • Installed but never activated: delete the affected plugin files, install 3.0.124, and run a security scan.
  • Downloaded but never installed: the download alone does not indicate a compromise.

The window in other time zones: it began October 15 at 16:02 EDT (22:02 CEST). To check your version, run wp plugin list | grep -i rank if you use WP-CLI, or read the version on the Plugins screen. Check staging and development copies too.

Indicators to look for

Rank Math published these signs of the backdoor. Any one of them on your site means it is infected.

  • Options in the database: rows in wp_options with option_name of _uf6qdn2hmm, t8krdk990phb or _np5pvf754c. Check with wp option get _uf6qdn2hmm and the other two names.
  • Admin accounts: usernames that start with wpsupport_ followed by random characters, or emails ending in @wp-mail.net. List administrators with wp user list --role=administrator.
  • A fake core file: wp-includes/class-wp-cache-util.php. That file is not part of WordPress.
  • Network traffic: outgoing connections to rank1cdn.com.
  • .htaccess rules that make .cache files run as PHP.
  • Cron entries on the server tagged #ms6v46 (check crontab -l for every system user you can).
  • Code patterns: base64_decode combined with XOR loops, the string xmmqhn, proc_open, and PHP-FPM socket code.

Rank Math also lists places to search: wp-content/mu-plugins/, other plugin folders, the inc/, includes/ and lib/ folders of non-default themes, Rank Math's own includes/ folder, and PHP files in wp-content/uploads/. On the server, check SSH authorized_keys, crontabs and running processes. Our guide to finding a backdoor in WordPress walks through these searches.

What to do now

Rank Math offers two routes.

Option 1: restore a clean backup. Restore both files and database from a backup made before October 15, 2026 at 20:02 UTC. Then scan the site, rotate all passwords and credentials, and install 3.0.124. This is usually faster and more reliable if you have a good backup.

Option 2: clean the site manually, in this order:

  1. Delete the rank-math-pro plugin folder, delete the three wp_options rows above, and block outgoing connections to rank1cdn.com.
  2. Search for every indicator above and remove the malicious files, cron entries and accounts.
  3. Rotate credentials: WordPress passwords, database password, the security keys and salts in wp-config.php, API keys, hosting, FTP and SSH access, and two-factor setups.
  4. Verify with wp core verify-checksums and wp plugin verify-checksums --all (premium plugins may not support the second command), then run a scan. Watch outgoing connections and check whether removed files come back.

Install 3.0.124 only after the cleanup, and only from your account at rankmath.com. Rank Math says it will never email login or download links, so treat any such email as phishing.

A backdoor that recreates itself is the reason to be thorough. If files reappear after you delete them, something is still running, often a cron job or a must-use plugin. Our guide to why WordPress sites keep getting hacked explains how reinfection usually happens.

When to get help

If the indicators are present and you are not comfortable working in the database and on the server, get help before the attacker uses the access. Our WordPress malware removal service covers backdoor cleanup, credential rotation and verification. For a first look on your own, start with what to do in the first hour after a hack.

Sources