A supply-chain attack on a leading WordPress SEO plugin has many owners asking: is my site affected? The Rank Math PRO backdoor shipped inside copies of the paid plugin for a short window in mid-October 2026. It rewards fast, calm action — and punishes the assumption that a simple update fixes everything.
This guide covers what happened, who must act, how to check if Rank Math is compromised, and the recovery steps for each situation. Free-plugin users can relax; PRO users should read the checklist before doing anything else.
The Rank Math PRO 3.0.123 Malware: What Happened
Rank Math confirmed a supply-chain attack on its paid WordPress SEO plugin. Copies of Rank Math PRO version 3.0.123 downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15, 2026 and 07:12 UTC on October 16, 2026 — an approximately 11-hour window — contained malware that installs a hidden, self-restoring backdoor.
A supply-chain attack means the code arrived through the normal update channel, not a hacked site or weak password — so even careful owners could have picked it up. Tracked as CVE-2026-111862 (CVSS 9.8, Critical), it was logged by Wordfence and Patchstack on October 17, 2026.
What the Rank Math PRO Backdoor Does
This is not a one-time infection that vanishes when you delete a single file. The malware recreates its backdoor whenever someone visits the infected site. Once installed, it can:
- Drop PHP backdoors in plugins, themes, and mu-plugins folders
- Create rogue administrator accounts with the
wpsupport_prefix - Add a fake WordPress core file at
wp-includes/class-wp-cache-util.php - Modify
.htaccessso.cachefiles can execute as PHP - Plant scheduled tasks and SSH keys for persistent access
- Expose database credentials, API keys, and cloud credentials
- Communicate with the domain rank1cdn.com
Outbound connections to rank1cdn.com are a strong compromise signal — check your server logs, firewall, or security plugin for them. Vendor indicators also include malicious wp_options rows, one named _np5pvf754c. Finding any artifact above means full recovery, not a quick cleanup.
Is the Rank Math Free Plugin Safe?
Yes. The free Rank Math SEO plugin distributed via WordPress.org, with more than 4 million installs, was NOT affected. Only the paid PRO version distributed through rankmath.com during the 11-hour window carried the malware.
Free-plugin users need not restore a backup or rotate credentials over this incident — just keep the plugin updated and scan routinely.
Who Is Affected vs Who Is NOT Affected
What matters is not just whether you downloaded version 3.0.123, but whether you installed and activated it:
| Your situation | Affected? | What to do |
|---|---|---|
| Installed AND activated a tainted 3.0.123 copy | Yes — treat the site as fully compromised | Restore files + database from a backup made BEFORE Oct 15, 2026 at 20:02 UTC, scan, rotate ALL credentials, then install clean 3.0.124 |
| Installed 3.0.123 but never activated it | Lower risk, but do not ignore it | Delete the plugin files, install clean 3.0.124 from the Rank Math account portal, and run a full scan |
| Downloaded 3.0.123 but never installed it | No indication of compromise from this incident alone | Delete the downloaded file; install clean 3.0.124 if you want PRO |
| Only use the free Rank Math plugin from WordPress.org | No | No action needed for this incident; keep the plugin updated |
| Use a different SEO plugin entirely | No | No action needed for this incident |
Unsure about your copy? Check your update history, hosting file timestamps, and Rank Math download records. When in doubt, scan — it costs minutes, while a missed backdoor costs far more.
How to Check If Rank Math Is Compromised
Work through this checklist, moving to full recovery if any check comes back positive:
- Version and timing. Did you download or update Rank Math PRO to 3.0.123 between 20:02 UTC on October 15, 2026 and 07:12 UTC on October 16, 2026? If not, this incident likely does not apply to you.
- Rogue admin accounts. In WordPress admin, go to Users and look for any administrator starting with
wpsupport_that you did not create. - Fake core file. Check whether
wp-includes/class-wp-cache-util.phpexists on your server. It is not a legitimate WordPress core file. - wp_options table. Look for suspicious rows, including one named
_np5pvf754c, using your hosting control panel’s database tool. - .htaccess and scheduled tasks. Look for rules allowing
.cachefiles to run as PHP, and for scheduled tasks you did not create. - Outbound traffic. Ask your host or security plugin whether your site has connected to rank1cdn.com.
- Full malware scan. Use a reputable scanner. A clean scan is not proof of safety, but a positive finding confirms full recovery is needed.
Do not just delete a suspicious file: the backdoor is self-restoring, so partial cleanup will likely fail.
Recovery Steps If Your Site Is Compromised
For sites that installed and activated a tainted copy, updating alone does NOT remove the malware:
- Restrict access to the site while you work, if possible.
- Restore from a clean backup — both files and database — made BEFORE October 15, 2026 at 20:02 UTC. A later backup may already contain the backdoor.
- Run a full security scan on the restored site to confirm no malicious files, rogue accounts, or scheduled tasks remain.
- Rotate ALL credentials. Change WordPress admin passwords, reset WordPress salts in
wp-config.php, change database credentials, rotate API keys, and change hosting and SSH credentials. Assume anything stored on the compromised site may have been exposed. - Install clean version 3.0.124 from the Rank Math account portal — not from an old downloaded copy.
- Re-scan and monitor for several days, watching for new admin accounts and suspicious outbound traffic.
Installed but never activated? Just delete the plugin files, install clean 3.0.124, and run a full scan — escalating to the full steps above if anything suspicious appears. If a restore and credential rotation feels beyond you, get professional help rather than risk a half-finished cleanup: our WordPress and SEO services cover recovery and hardening, and you can reach us via our contact page.
Does Updating to 3.0.124 Remove the Malware?
No. This is the most dangerous misunderstanding about this incident. Clean version 3.0.124 stops new infections, but it does not remove a backdoor already installed.
Updating replaces the plugin, but the malware’s planted files, accounts, scheduled tasks, and possibly SSH keys elsewhere on your site survive it. Hence the guidance for activated copies: full restore plus credential rotation, not just an update. Update to 3.0.124 only after those steps.
Why Small Sites Should Take This Seriously
Small WordPress sites are attractive targets precisely because they are often less monitored: a backdoor can send spam, host phishing pages, redirect visitors, or steal credentials without the owner noticing for weeks. Build lasting habits — verified off-site backups, alerts for new admin accounts and file changes, minimal administrator accounts, and prompt credential rotation after any compromise. See also our guides on AI tools for cybersecurity and cybersecurity threats for small businesses.
Frequently Asked Questions
Is the free Rank Math plugin safe?
Yes. The free plugin via WordPress.org was NOT affected — only paid PRO 3.0.123 copies from rankmath.com during the October 15–16, 2026 window carried the malware. Free-plugin users need take no action.
How do I know if my site got the bad version?
Check whether you got PRO 3.0.123 between 20:02 UTC on October 15, 2026 and 07:12 UTC on October 16, 2026, then look for the indicators above: wpsupport_ accounts, the fake wp-includes/class-wp-cache-util.php file, the _np5pvf754c row, modified .htaccess rules, unexpected tasks or SSH keys, and rank1cdn.com traffic. Run a full scan too.
Does updating to 3.0.124 remove the malware?
No. Clean 3.0.124 prevents new infections but does not remove an installed backdoor. Activated tainted copies require a pre–October 15, 2026 20:02 UTC backup restore, a scan, full credential rotation, and only then 3.0.124.
What if I have no clean backup?
Do not rely on updating alone. Get professional malware removal: a specialist can clean the backdoor files, rogue accounts, tasks, and SSH keys, then verify with a full scan. After cleanup, rotate all credentials before bringing the site fully back online, and set up automated off-site backups.
Conclusion: Act on Facts, Not Panic
The Rank Math PRO backdoor is serious but narrow: an 11-hour window, one paid plugin version, and a clear recovery path. Free-plugin users can relax; PRO users who installed and activated a tainted 3.0.123 copy must treat their sites as fully compromised and complete the restore, scan, and credential-rotation sequence, while download-only or never-activated users should still clean up and scan. The worst response is updating to 3.0.124 and assuming the problem is solved. Check your version and indicators, restore from a clean backup if affected, and rotate every credential — that closes this backdoor and leaves your site better protected for the next incident.
Sources: BetaNews coverage of the Rank Math malware, SparTech Software on the Rank Math PRO supply-chain backdoor, PrivacyNeedle on the Rank Math PRO supply-chain attack
