MeanCEO: Tech Startups and Startup Ideas

Rank Math PRO 3.0.123 Shipped Malware. Check Your WordPress Site Today

TL;DR: Is there a backdoor in Rank Math?

In some copies of Rank Math PRO, yes. Rank Math says users who downloaded or updated to PRO version 3.0.123 between 15 October 2026, 20:02 UTC, and 16 October, 07:12 UTC received plugin files with malware. It can keep a hidden backdoor alive on your site, and Rank Math says to assume every password and key the site could reach has been exposed. The clean version is 3.0.124, but updating does not remove the malware. If you activated an infected copy, you have to clean the site and change all your credentials. The free Rank Math plugin isn't named in the notice.
If your WordPress site runs Rank Math PRO and updates itself, check it today. It takes five minutes to find out whether you're affected, and much longer to clean up if you wait.
Rank Math is one of the most popular SEO plugins on WordPress; the free version alone has more than 4 million active installs on WordPress.org. Many bootstrapped founders run it on their company site, blog or WooCommerce shop. That's what makes a poisoned update so dangerous: you install it because you trust the vendor.

What happened

On 16 October 2026, Rank Math published a security notice that begins: "We recently identified a security issue affecting a limited number of users who downloaded Rank Math PRO v3.0.123". The key facts:
  • Which version: only Rank Math PRO 3.0.123, and only copies downloaded or updated between 15 October, 20:02 UTC (22:02 CEST), and 16 October, 07:12 UTC. Having 3.0.123 alone doesn't prove you got an infected copy.
  • What Rank Math did: "We immediately removed the affected files and released a clean version, Rank Math PRO v3.0.124."
  • What it didn't say: how the malware got into the files, or how many customers received them. It only says "a limited number of users".
  • 17 October: WordPress security company Wordfence issued a public warning, and the issue was listed as CVE-2026-111862 with a CVSS score of 9.8 out of 10 (critical). The CVE is still reserved, so the official US database has no details yet.
Some headlines say the backdoor is "exploited in the wild". No security company has reported attacks on sites beyond the infected copies themselves. But every site that activated one of those copies ran the malware, so for those sites, the attack already happened. Three days later a bigger risk arrived for every WordPress owner: a critical PHP vulnerability in the language that runs the server under the plugin.

What the malware does

According to Rank Math, the malware "can recreate its hidden backdoor whenever someone visits the website". That means deleting one bad file isn't enough: the next visitor brings it back. Rank Math lists these signs:
WhereWhat to look for
UsersAdministrator accounts starting with wpsupport_, or with an email ending in @wp-mail[.]net
Database (wp_options)Rows named _uf6qdn2hmm, t8krdk990phb and _np5pvf754c
NetworkConnections to rank1cdn.com
FilesA fake core file wp-includes/class-wp-cache-util.php, and PHP files hidden in mu-plugins, other plugins, theme folders and uploads
.htaccessRules that let .cache files run as PHP
ServerA cron job tagged #ms6v46, plus new SSH keys
On credentials, Rank Math is blunt: "assume that credentials and secrets accessible to the compromised website may have been exposed." On a typical founder's site, that's your WordPress logins, the database password, Stripe or Mollie keys, your email (SMTP) login, and any API keys saved in plugins.

Are you affected? Four cases

Start in WordPress: go to Plugins and look at the Rank Math PRO version. If it says 3.0.123, check when it was updated (your hosting logs or an activity-log plugin can tell you). If it updated itself overnight on 15–16 October, assume the worst.
What about the free plugin? Rank Math's notice only names PRO. The free plugin's last update on WordPress.org was on 6 October, before the window, which suggests it wasn't touched. But Rank Math hasn't said so in writing.

How to clean your site

Rank Math's preferred fix is to restore your files and database from a backup made before 15 October, 20:02 UTC. If you don't have one, do this in order, because "removing suspicious files before disabling the mechanism that recreates them may not resolve the issue":
  1. Delete the whole rank-math-pro folder. "Deactivating the plugin alone is not sufficient."
  2. Delete the three database rows listed above, and block rank1cdn.com.
  3. Hunt down the rest: rogue admin users, the fake class-wp-cache-util.php, .htaccess rules, cron jobs and SSH keys. If you use WP-CLI, run wp core verify-checksums and wp plugin verify-checksums --all, then check whether deleted files come back.
  4. Change everything, even after restoring a backup ("This step is essential", Rank Math says): all WordPress passwords, the database password, the security keys and salts in wp-config.php, payment, email and API keys, hosting, FTP and SSH logins. Turn on two-factor login for admins. It's also worth revoking WordPress application passwords.
  5. Install 3.0.124 yourself from your account at rankmath.com. Rank Math warns: "We will never send login or download links by email." Expect phishing emails pretending to be the fix.
If you're not comfortable doing this yourself, pay a WordPress security service or your host to do it. A few hundred euros is cheaper than a hacked shop.

The European angle: you may have to report it

If your site holds customer data (a WooCommerce shop, a membership site, newsletter signups, contact forms) and an infected copy ran on it, this may be a personal data breach under the GDPR. Article 33 says you must notify your national data protection authority "not later than 72 hours after having become aware of it", unless the breach is "unlikely to result in a risk" to people. Rank Math's notice doesn't cover this, and this isn't legal advice. But write down what you found and when, and check with your data protection authority or adviser. Our GDPR compliance checklist for early-stage startups covers the basics.

Not the first poisoned WordPress plugin

Supply-chain attacks, where criminals poison software at the source, keep hitting WordPress because one plugin reaches millions of sites:
WhenWhat happenedWho was hit
September 2021 (found January 2022)AccessPress Themes' own website was hacked and its downloads carried a backdoorSites that downloaded from the vendor, not WordPress.org
June 2024Five plugins on WordPress.org were backdoored, including Social Warfare35,000+ sites; malware created rogue admins
August 2026Rank Math's free plugin 1.0.277 created an admin-level application password for its Support AgentNot malware; Rank Math paused the feature
15–16 October 2026Malware in Rank Math PRO 3.0.123 downloadsPRO customers who updated in the window
The June 2024 attack was covered by BleepingComputer. The August 2026 Support Agent issue was a separate debate: Rank Math paused the feature and said it "does not elevate beyond" the user's role. Nobody has linked it to this week's malware.

What this means for you

  1. Check your plugin versions today, not just Rank Math. Make a list of every plugin on every site you run; small founders often forget the old landing page on a second domain.
  2. Have backups you can actually restore. Rank Math's best advice depends on a backup from before the attack. Daily off-site backups, kept for at least 30 days, are the cheapest security you can buy.
  3. Rethink auto-updates for paid plugins. Auto-updates fix known holes fast, so don't turn them off everywhere. But on a shop or membership site, waiting a day or two on big paid plugins gives the vendor time to catch a bad release.
  4. Keep secrets out of WordPress where you can. Use restricted API keys, separate logins per service and two-factor login, so one hacked site doesn't open your whole business. Our guide to the back-office stack for bootstrapped founders and essential startup tool stack help you keep it lean.
  5. Watch Search Console after a cleanup. Hacked sites often get spam pages injected. Look for strange new pages and security warnings in Google Search Console, and run through our technical SEO checklist once the site is clean.
For more, see our WordPress news for October 2026 and cybersecurity news for October 2026.
Are you getting customers from ChatGPT yet?

More and more traffic is coming from Perplexity, ChatGPT, Grok and other AI tools.

👉 Rank on ChatGPT

FAQ: the Rank Math PRO malware

Which Rank Math version has the backdoor?

Rank Math PRO 3.0.123, but only copies downloaded or updated between 15 October 2026, 20:02 UTC, and 16 October 2026, 07:12 UTC. The clean version is 3.0.124.

Is the free Rank Math plugin affected?

Rank Math's notice only names PRO 3.0.123. The free plugin's last WordPress.org update was on 6 October 2026, before the window, but Rank Math hasn't explicitly said the free plugin is safe.

Does updating to 3.0.124 remove the malware?

No. Updating doesn't remove backdoors, rogue admin accounts or scheduled tasks the malware created. You need to delete the rank-math-pro folder, remove the malware's traces, and change all credentials, or restore a clean backup.

How do I know if my site was infected?

Look for admin users starting with wpsupport_, the wp_options rows _uf6qdn2hmm, t8krdk990phb and _np5pvf754c, a file called wp-includes/class-wp-cache-util.php, connections to rank1cdn.com and a cron job tagged #ms6v46.

I only downloaded the zip. Am I at risk?

Rank Math says there's no indication a site is compromised if the file was only downloaded and never installed. Delete it and download 3.0.124 from your Rank Math account.

Do I have to report this under the GDPR?

If an infected copy ran on a site with personal data, it may count as a personal data breach. Article 33 of the GDPR requires notifying your data protection authority within 72 hours unless the risk to people is unlikely. Get advice for your case.

About the Author

Violetta Bonenkamp, also known as MeanCEO, is an experienced startup founder with an impressive educational background including an MBA and four other higher education degrees. She has over 20 years of work experience across multiple countries, including 5 years as a solopreneur and serial entrepreneur. Throughout her startup experience she has applied for multiple startup grants at the EU level, in the Netherlands and Malta, and her startups received quite a few of those. She’s been living, studying and working in many countries around the globe and her extensive multicultural experience has influenced her immensely.
2026-10-18 10:17 News and Trends