Rank Math PRO Shipped Malware: What Site Owners Should Do

Rank Math warned on October 16, 2026 that some copies of its paid plugin, Rank Math PRO 3.0.123, contained malware. It affects WordPress sites that downloaded or updated the plugin between 20:02 UTC on October 15 and 07:12 UTC on October 16. The clean release is 3.0.124.

What we know

  • The notice: Rank Math published it at 20:32 UTC on October 16 and updated it on October 17. It says the affected files contained malware that could compromise a site once the plugin was activated.
  • The window: per the notice, 20:02 UTC on October 15 to 07:12 UTC on October 16. Outside that window, version 3.0.123 alone does not mean a copy is infected: the changelog dates that release to October 7.
  • Who: Rank Math refers to "a limited number of users", gives no count, and does not explain how the malware got into its files.
  • Severity: Patchstack listed it on October 17 as CVE-2026-111862, an unauthenticated backdoor rated 9.8 out of 10. It adds that a firewall rule cannot block it, because the attack hit Rank Math's own systems.
  • Deactivating is not enough: the notice says to delete the plugin folder and warns that the malware can recreate its backdoor whenever someone visits the site.
  • Emails: Rank Math says it never sends login or download links by email, and that some users may be unable to sign in and may need to reset their account password.
  • The free plugin: the notice only covers Rank Math PRO 3.0.123. It does not mention the free version on wordpress.org.

What changes and what doesn't

If you only run the free plugin, the notice asks nothing of you. If you run PRO and it updated during those hours, updating does not fix it: when the plugin was activated, Rank Math says to treat the site as compromised even if it now shows 3.0.124.

According to The Hacker News, which covered it on October 19, this is at least the third time this year that a premium WordPress plugin vendor has shipped malware through its own update channel.

How to tell if you're affected

  1. Check whether your site runs Rank Math PRO. In WordPress, open "Plugins" and look for "Rank Math SEO PRO" and its version. If you only see "Rank Math SEO", that is the free plugin.
  2. Check the date. If you had 3.0.123, find out when it was installed or updated: your security plugin's activity log, your host's history, or whoever manages the site. What matters is whether it landed inside the window. Convert it to your own time zone before you look.
  3. If it was activated in the window: Rank Math's recommended route is to restore a backup taken before 20:02 UTC on October 15, then install 3.0.124 by signing in at rankmath.com yourself.
  4. If you have no such backup, cleanup is manual and has an order: delete the plugin folder, remove the three wp_options entries listed in the notice, and, if you can, block outgoing connections to the domain rank1cdn.com. Then look for the other signs: admin accounts starting with "wpsupport_", the file wp-includes/class-wp-cache-util.php (not a WordPress core file), and unfamiliar scheduled tasks. If you don't manage your hosting, ask your provider to do it and send them the notice.
  5. Rotate every secret, even after a restore: WordPress, database, wp-config keys, hosting, FTP or SSH, and any payment, email or AI API keys stored on the site.
  6. Distrust emails offering the clean version through a link.

Related: All in One SEO Plugin: Two Security Flaws, Update Now

Sources

Updates: if Rank Math explains how the malware got in or how many sites received it, it will be added here with a link.