Copies of Rank Math PRO, a paid SEO plugin for WordPress, downloaded or updated between 20:02 UTC on 15 October and 07:12 UTC on 16 October contained a backdoor. If your site installed and activated it in that window, treat it as compromised: restore an earlier backup, change every credential and install 3.0.124.
Key facts
- The affected window runs from 20:02 UTC on 15 October to 07:12 UTC on 16 October, roughly 11 hours, according to Rank Math's notice as reported by The Hacker News.
- Wordfence assigned the identifier CVE-2026-111862, scored 9.8 out of 10. Patchstack says no mitigation rule is possible because the attack happened inside the vendor's own systems (SecurityWeek).
- The version number isn't enough: the changelog dates 3.0.123 to 7 October. Only copies downloaded or updated within the window are affected.
- The clean version is 3.0.124. Installing it does not remove files, admin accounts or scheduled tasks the malware has already left behind, according to Wordfence.
- Only the PRO version is affected. The free plugin on WordPress.org, with more than 4 million active installs, is not mentioned in the notice.
Am I affected if I use Rank Math?
Only if you use the PRO version, which is downloaded and updated from rankmath.com. If your website, online shop or blog runs it, you need to find out when it was last installed or updated. If you're an agency, this applies to every client site.
The catch is that Rank Math hasn't explained how the malicious files got into its download system, how many customers received them, or whether automatic updates delivered them. If you have auto-updates on, don't rule it out: ask your web provider.
What can the malware do on my server?
Quite a lot. It creates a hidden backdoor that can regenerate every time someone visits the site. It talks to the domain rank1cdn[.]com and can create administrators, modify other plugins and themes, change .htaccess so .cache files run as PHP, add scheduled tasks and SSH keys, and create the file wp-includes/class-wp-cache-util.php, which is not part of WordPress.
BleepingComputer found a PHP sample on VirusTotal that appears to be the first stage of the attack. It can run commands, modify the database and steal AWS, Cloudflare, Google Cloud and Azure credentials, plus SSH keys. In other words, the risk doesn't stop at the website: it reaches any service the server had access to.
What to do today
- Check whether your sites use Rank Math PRO and when it was installed or updated. If an agency or provider manages the site, ask them today, especially if updates are automatic.
- If it was installed and activated within the window, restore a backup from before 20:02 UTC on 15 October and scan the site.
- Change all WordPress passwords, database credentials, API keys and the credentials for any cloud service the server could reach.
- Only then install 3.0.124, downloaded directly from your rankmath.com account.
- If you have no clean backup, delete the entire plugin folder (deactivating it isn't enough), remove the malicious database entries and look for suspicious PHP files, unknown administrators, scheduled tasks, added SSH keys and .htaccess changes.
- Block outbound connections to rank1cdn[.]com.
- If the plugin was installed but never activated, delete it, install 3.0.124 and scan the site.
- If the site handles customers' personal data, check with your DPO or adviser whether you need to assess a possible breach under GDPR.
What it means for a small business
Those infected here did exactly what is always recommended: paid for a plugin and kept it up to date. The attack came through the vendor's official channel, which is why no firewall rule could stop it. According to The Hacker News, this is at least the third case this year of a premium WordPress plugin delivering backdoored versions through its own update system.
Our take: stopping updates makes no sense, because outdated plugins are a risk of their own. What does make sense is preparing for the day the vendor fails. That means three things. Backups with several days of retention, so you can roll back to a specific point. An inventory of paid plugins and who controls their updates. And a web server that holds no more credentials than strictly necessary: if your WordPress stores AWS or Azure keys with broad permissions, a compromised SEO plugin becomes a problem for your whole infrastructure.
If you aren't sure who manages your websites or which credentials live on that server, now is the time to find out. If you need help reviewing it, take a look at our cybersecurity service.
Frequently asked questions
I use the free version of Rank Math. Do I need to do anything?
The free plugin on WordPress.org is not mentioned in the notice. The incident affects only the PRO version distributed from rankmath.com.
If I have version 3.0.123, am I infected?
Not necessarily. Only copies downloaded or updated between 20:02 UTC on 15 October and 07:12 UTC on 16 October are affected. What matters is the date, not the number.
Is deactivating the plugin or updating to 3.0.124 enough?
No. Deactivating it doesn't remove the malware, and 3.0.124 doesn't delete the files, administrators or scheduled tasks it has already created.
