Rank Math PRO 3.0.123 (CVE-2026-111862): vendor download and update channel served a self-restoring WordPress backdoor

What happened

Rank Math PRO packages downloaded from rankmath.com or delivered as updates between 20:02 UTC on 15 October and 07:12 UTC on 16 October 2026 contained malware. Only PRO 3.0.123 obtained in that window is affected. The fix is 3.0.124 (Rank Math).

The CVE record, assigned by Wordfence, describes it as a supply-chain compromise “in a subset of version 3.0.123 packages” (CVE-2026-111862). The Hacker News reports a CVSS score of 9.8 and that the domain rank1cdn[.]com was registered at 19:31 UTC on 14 October, the day before (The Hacker News).

Rank Math has not said how the files got into its download and update system, how many customers received them, or whether auto-updates delivered them. It has not published hashes for clean or tainted packages (The Hacker News).

What the malware does

No public code analysis exists yet. Rank Math says the malware (Rank Math):

• recreates its hidden backdoor whenever someone visits the site, so deleting files in the wrong order does not work;
• connects out to rank1cdn.com;
• may leave PHP backdoors in other plugins, themes and mu-plugins, a fake core file, administrator accounts, .htaccess rules that run .cache files as PHP, cron jobs and SSH keys.

Am I affected?

Rank Math gives three cases (Rank Math):

• Installed and activated 3.0.123 in the window: compromised, even if you have since updated.
• Installed but never activated: delete the files, install 3.0.124, run a scan.
• Downloaded only: no sign of compromise from this incident alone.

Check the version and the database markers with WP-CLI:

wp plugin list --fields=name,status,version | grep -i 'rank-math'
wp db query "SELECT option_name FROM $(wp db prefix)options WHERE option_name IN ('_uf6qdn2hmm','t8krdk990phb','_np5pvf754c')"

Then look for the backdoor files, accounts and cron entries Rank Math lists:

# Fake core file
ls -la wp-includes/class-wp-cache-util.php 2>/dev/null

# Code markers: the XOR key and the outbound domain
grep -rlE 'xmmqhn|rank1cdn' wp-content/ wp-includes/ 2>/dev/null

# .cache files containing PHP, and .htaccess rules that execute them
grep -rl '<?php' --include='*.cache' . 2>/dev/null
grep -rn '\.cache' --include='.htaccess' . 2>/dev/null

# PHP in uploads
find wp-content/uploads -name '*.php' 2>/dev/null

# Rogue administrators
wp user list --role=administrator --fields=user_login,user_email | grep -E 'wpsupport_|@wp-mail\.net'

# Cron
crontab -l -u www-data 2>/dev/null | grep 'ms6v46'
wp cron event list

Adjust www-data to your web server user. Check outbound logs for rank1cdn.com. Wordfence cautions that the absence of these markers “does not, by itself, prove that a website is clean” (The Hacker News).

What to do now

Preferred: restore. Restore files and database from a backup taken before 20:02 UTC on 15 October 2026, scan, rotate credentials, then install 3.0.124 from your rankmath.com account (Rank Math).

Without a clean backup, follow this order (Rank Math):

1. Delete the whole rank-math-pro folder by FTP or file manager. Do not just deactivate it.
2. Delete the three wp_options rows: _uf6qdn2hmm, t8krdk990phb, _np5pvf754c.
3. Block outbound connections to rank1cdn.com if you can.
4. Remove the rest: wp-includes/class-wp-cache-util.php, PHP in mu-plugins, theme inc/, includes/ and lib/ folders, Rank Math’s includes/ and uploads/, .cache files with PHP and the .htaccess rules for them, wpsupport_ administrators, #ms6v46 crontab lines, and unknown SSH keys. Run wp core verify-checksums and reinstall other plugins and themes from official sources.
5. Rotate every credential: WordPress passwords, the database password in wp-config.php, the security keys and salts, payment, SMTP and other API keys, hosting panel, FTP, SFTP and SSH logins, environment-variable secrets, and administrator 2FA.
6. Install 3.0.124 from your Rank Math account and watch for removed files reappearing over the next days. If they do, get expert help.

There are no WordPress.org checksums for the PRO plugin, so wp plugin verify-checksums cannot vouch for it. Use a fresh download instead. Rank Math also says it never sends login or download links by email, so treat any such email about this incident as phishing.

Sources

• Rank Math: PRO 3.0.123 security incident
• CVE-2026-111862 record
• The Hacker News: Popular WordPress SEO plugin Rank Math PRO backdoored