Rank Math PRO 3.0.123 Backdoor: Check and Clean Your WordPress

Last updated: 26 October 2026. Sources are listed at the end.

On 15 and 16 October 2026, the official update channel for Rank Math PRO served a poisoned version 3.0.123 for about 11 hours. The Rank Math PRO backdoor gives an attacker lasting access to any WordPress site that activated that copy. In addition, it can rebuild itself on a page visit. So a quick plugin update does not clean it up.

Rank Math has confirmed the incident in a security notice and released a clean build, 3.0.124. The free Rank Math SEO plugin from WordPress.org was not affected, according to the vendor. The issue is tracked as CVE-2026-111862 with a CVSS score of 9.8.

This guide explains what is confirmed, how to check your site with WP-CLI, and the clean-up order the vendor recommends. If you run PRO on client sites, check every one. The version number alone does not tell you whether a copy is clean.

The short answer

• Run wp plugin list on every site and look for Rank Math PRO 3.0.123. Then find out when that copy was installed or updated.
• Was 3.0.123 activated after an install between 20:02 UTC on 15 Oct and 07:12 UTC on 16 Oct 2026? Then treat the site as compromised.
• Best fix: restore a backup taken before 20:02 UTC on 15 October (01:32 IST on 16 October). Then rotate every secret and install 3.0.124.
• No clean backup? First delete the plugin folder and three malicious options, and block rank1cdn.com. Only then hunt for other backdoors.
• Simply updating to 3.0.124 is not enough. The update replaces the plugin but leaves planted files, users and cron jobs in place.

What the Rank Math PRO backdoor is

Rank Math PRO is the paid edition of a popular WordPress SEO plugin. Customers download it from rankmath.com, and the plugin also pulls updates from the vendor’s own servers. In other words, it does not come from WordPress.org.

During the incident window, those official downloads carried malicious code. Rank Math says the code could compromise a site once the plugin was activated. The vendor then removed the bad files and shipped 3.0.124 as the clean replacement.

So far, Rank Math has not explained how the attacker got files into its distribution system. It has also not said how many customers received the bad build, or whether auto-updates delivered it. BleepingComputer asked for both details and did not get an answer. The vendor only says “a limited number of users” downloaded the affected build.

Timeline

One detail matters here. According to The Hacker News, the 3.0.123 changelog is dated 7 October, before the window opened. Therefore a 3.0.123 copy installed before 20:02 UTC on 15 October falls outside this incident. Some news reports describe 3.0.123 as if it only existed during the window. However, the vendor and the CVE record tie the risk to the download time, not the version string.

What the backdoor does

The vendor notice and the security press describe the malware’s footprint. However, no full public reverse-engineering report was available to us at the time of writing. Here is what Rank Math lists as places to look:

• PHP backdoors dropped into wp-content/mu-plugins/, other plugin folders, theme inc/, includes/ and lib/ folders, and Rank Math’s own includes/ folder.
• Rogue administrator accounts whose usernames start with wpsupport_ or whose emails end in @wp-mail.net.
• A fake core file at wp-includes/class-wp-cache-util.php. This is not a real WordPress file.
• .htaccess rules that make .cache files run as PHP, plus .cache files that contain PHP code.
• Entries in the web server user’s system crontab tagged #ms6v46, and malicious WordPress scheduled events.
• Possible changes outside WordPress, such as SSH authorized_keys, other users’ crontabs and running processes.

The key problem with the Rank Math PRO backdoor is persistence. Rank Math warns that the malware can recreate its hidden backdoor whenever the site receives a visit. As a result, deleting a few files while the rebuild mechanism still exists may achieve nothing. The vendor says the plugin folder and three database options must go first.

BleepingComputer also found a related PHP sample on VirusTotal that steals cloud and SSH credentials. It could not confirm the plugin distributed that sample, so treat that link as unproven.

Exploitation status

The Rank Math PRO backdoor is not a bug that attackers need to exploit. Instead, the malicious code ran on activation, so every activated affected copy gave the attacker a foothold. Patchstack rates it a high-priority backdoor. It also says a virtual patch rule is not possible, because the bad code came from the vendor itself. The CVE is not in the CISA KEV catalogue. No public count of compromised sites exists.

Am I affected?

First, list your plugins from the WordPress root. We add --skip-plugins --skip-themes so that WP-CLI does not load possibly infected plugin or theme code while you look around.

cd /path/to/wordpress
wp --skip-plugins --skip-themes plugin list --fields=name,status,version | grep -i rank
wp --skip-plugins --skip-themes plugin get seo-by-rank-math-pro --field=version

The second command assumes the folder is seo-by-rank-math-pro, which is the slug Patchstack uses. Rank Math’s notice instead calls it the rank-math-pro folder. So use whatever name the first command shows.

Next, work out when the plugin was installed or updated. Check your update logs, your hosting panel’s activity history, or the file times on the plugin folder:

ls -la --time-style=full-iso wp-content/plugins/ | grep -i rank

An attacker can change file times, so use them as a hint, not as proof.

Check for Rank Math PRO backdoor IOCs

The script below only reads. It searches for the indicators Rank Math published. Run it from the WordPress root as the site’s own user. We tested it on a sample WordPress install seeded with fake copies of each indicator.

#!/usr/bin/env bash
# Read-only check for the Rank Math PRO 3.0.123 IOCs published by Rank Math.
# Run from the WordPress root (the folder holding wp-config.php).
WP="wp --skip-plugins --skip-themes"

echo "== Rank Math plugins and versions"
$WP plugin list --fields=name,status,version | grep -i rank

echo "== IOC options in wp_options"
for o in _uf6qdn2hmm t8krdk990phb _np5pvf754c; do
  $WP option get "$o" >/dev/null 2>&1 && echo "FOUND option: $o"
done

echo "== Suspicious admin accounts"
$WP user list --role=administrator --fields=ID,user_login,user_email,user_registered \
  | grep -Ei 'wpsupport_|@wp-mail\.net'

echo "== Fake core file"
ls -la wp-includes/class-wp-cache-util.php 2>/dev/null

echo "== PHP files carrying the XOR key"
grep -rIl --include='*.php' 'xmmqhn' wp-content wp-includes 2>/dev/null

echo "== .cache files that contain PHP"
find . -type f -name '*.cache' -exec grep -l '<?php' {} + 2>/dev/null

echo "== .htaccess lines mentioning .cache"
find . -name .htaccess -exec grep -Hn '\.cache' {} + 2>/dev/null

echo "== PHP files inside uploads"
find wp-content/uploads -type f -name '*.php' 2>/dev/null

echo "== mu-plugins changed since 15 Oct 2026"
find wp-content/mu-plugins -type f -newermt '2026-10-15 20:00 UTC' 2>/dev/null

echo "== Crontab entries tagged ms6v46 (current user)"
crontab -l 2>/dev/null | grep -n 'ms6v46'

Also review the full admin list and cron events by eye. The attacker may vary names:

wp --skip-plugins --skip-themes user list --role=administrator
wp --skip-plugins --skip-themes cron event list --fields=hook,next_run_relative,recurrence
grep -rIl -e 'proc_open' -e 'base64_decode' wp-content/mu-plugins wp-content/plugins wp-content/themes

Note that proc_open and base64_decode also appear in legitimate plugins, so read each hit before you delete anything. Finally, a clean result is not proof of a clean site. Wordfence, as quoted by The Hacker News, warns that missing indicators do not by themselves prove a site is clean.

How to clean up, in the right order

To remove the Rank Math PRO backdoor, the vendor prefers a restore from a backup made before 20:02 UTC on 15 October. Then scan, rotate secrets and install 3.0.124. Otherwise, follow the manual order below. These steps change the site, so take a copy first.

1. Take a forensic copy of files and database before touching anything, for example with tar and wp db export. Keep it offline, because it contains the malware.
2. Delete the whole Rank Math PRO folder from the shell. Deactivating is not enough.
3. Remove the three options: wp --skip-plugins --skip-themes option delete _uf6qdn2hmm t8krdk990phb _np5pvf754c.
4. Block outbound traffic to rank1cdn.com at the server firewall, proxy or DNS. On shared hosting, ask your host to do this.
5. Remove PHP backdoors in mu-plugins, plugins, themes and uploads. Then reinstall plugins and themes from official sources.
6. Delete wp-includes/class-wp-cache-util.php and run wp core verify-checksums.
7. Fix .htaccess and delete any .cache files that contain PHP.
8. Remove rogue admins with wp user delete <ID> --reassign=<your ID>. Then remove crontab lines tagged #ms6v46 and bad WordPress cron events.
9. Check SSH authorized_keys, other users’ crontabs and running processes.
10. Rotate everything: WordPress passwords, database password, salts (wp config shuffle-salts), API, SMTP and payment keys, hosting, FTP and SSH logins. Also turn on two-factor login for admins.
11. Download 3.0.124 by logging in at rankmath.com directly, and install it.
12. Scan again and watch for removed files coming back over the next few days.

Rank Math notes that wp plugin verify-checksums will not cover premium plugins, since WordPress.org holds no checksums for PRO. Also, the vendor says it never emails login or download links, so ignore any “urgent update” email.

WAF and hosting notes

A web application firewall cannot block this one by signature, as Patchstack points out. Still, egress filtering helps: a server that cannot reach rank1cdn.com cannot easily phone home. Ask your host whether it scanned shared servers for these indicators. For agencies, the same checks apply to every site that shares a PRO licence.

India angle

Rank Math itself gave the backup cutoff in IST: 01:32 on 16 October. Indian agencies often run PRO across many client sites, so audit each one. If you fall under the CERT-In April 2022 Directions, report a confirmed compromise within six hours. The DPDP Rules’ breach notice under Rule 7 applies only from May 2027, so it is not yet in force. Still, record what personal data the site held now.

Quick checklist

• ☐ List Rank Math versions on every WordPress site
• ☐ Confirm install or update time for any 3.0.123 copy
• ☐ Run the read-only IOC check
• ☐ Restore a pre-15 October backup, or follow the manual order
• ☐ Delete the plugin folder and the three options first
• ☐ Block rank1cdn.com outbound
• ☐ Remove rogue admins, cron entries, fake core file and .cache rules
• ☐ Rotate salts, passwords, database and API keys
• ☐ Install 3.0.124 from rankmath.com only
• ☐ Rescan and monitor for a week

Supply-chain backdoors in WordPress plugins are becoming a pattern; see also our guide to the UpdraftPlus UpdraftCentral backdoor. For a wider hardening pass on shared hosting, see our PHP2Shell WordPress checklist. If you would like a second pair of eyes on a cleaned site, our VAPT services team can help.

Sources

• Rank Math: PRO 3.0.123 security incident notice
• Patchstack: Rank Math SEO PRO 3.0.123 backdoor entry
• OpenCVE: CVE-2026-111862
• The Hacker News: Rank Math PRO malware incident
• BleepingComputer: Rank Math compromised to backdoor websites
• SecurityWeek: Rank Math PRO compromised in supply chain attack
• eSecurity Planet: Malicious Rank Math PRO update

Need help finding and fixing exposed systems? Our VAPT services find unpatched and exposed systems before attackers do, and our free website safety check grades your site in seconds. Contact us for a quote.