Rank Math PRO 3.0.123 Shipped With a Backdoor for 11 Hours

If you downloaded or updated Rank Math PRO 3.0.123 between 20:02 UTC on October 15 and 07:12 UTC on October 16, your WordPress site may have a backdoor in it.

Running the PRO plugin on your sites? Check them today.

What happened

According to Rank Math’s security incident page, the 3.0.123 files could compromise your site once activated. Rank Math pulled them and released 3.0.124 as the clean version.

It says only “a limited number of users” got the bad build. It didn’t give a count.

But it hasn’t said how the attackers got in. BleepingComputer asked about the attack vector and the number of affected sites, and had no answer when it published on October 19.

The free plugin from WordPress.org wasn’t affected.

What the malware does

The backdoor rebuilds itself when someone visits your site, so deleting files alone may not work. Rank Math and SecurityWeek’s report on the compromise list what it may do:

• Talk to an attacker domain, rank1cdn.com
• Create admin accounts with usernames starting “wpsupport_” or emails ending “@wp-mail.net”
• Drop a fake core file at wp-includes/class-wp-cache-util.php
• Change .htaccess so .cache files run as PHP
• Add cron jobs, edit other plugins and themes, and make changes outside WordPress
• Expose database credentials, API keys and other secrets on your server

Which case are you in?

It depends on what you did with Rank Math PRO 3.0.123:

1. Downloaded but never installed: this incident alone doesn’t mean you’re compromised, says Rank Math.
2. Installed but never activated: delete it, install 3.0.124 from your Rank Math account, and run a security scan.
3. Installed and activated: treat your site as compromised.

Why it matters

So if you’re in that third group, updating to 3.0.124 isn’t the cleanup: Rank Math says to recover first and install it last. Restore a backup from before 20:02 UTC on October 15.

No clean backup? Then follow Rank Math’s manual cleanup in the order it gives. Delete the whole rank-math-pro folder, remove the bad database options and block rank1cdn.com.

After that, rotate everything: WordPress passwords, database credentials, salts, API keys, SMTP, FTP and SSH access.

I think agencies have it worse.

Of course, you might run Rank Math PRO across several client sites and not know who updated what that night.

Rank Math’s advisory doesn’t say whether automatic updates pushed the bad build. Its advice is to check whether you installed and activated 3.0.123 during the affected period.

Still, watch your inbox. Rank Math says some free users’ account details may have been deleted, and it emailed instructions to re-create any affected account, so check any email closely. Log in at rankmath.com yourself.

Is this a reason to drop premium plugins? I don’t think so. Keep daily off-site backups for every site you can’t lose.

A backup from the day before makes this a quick restore.

Common Questions

Is the free version of Rank Math SEO affected by the 3.0.123 malware?

No. Only Rank Math PRO 3.0.123, downloaded between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026, was affected. Rank Math says the free version on WordPress.org is not affected, and no action is needed.

Does updating Rank Math PRO to 3.0.124 remove the malware?

Not by itself on a site where Rank Math PRO 3.0.123 was activated. The backdoor can rebuild itself every time someone visits the page, so Rank Math advises you to restore a clean backup from before 20:02 UTC on October 15 or follow its manual cleanup, then change every password and key you have.

How do I know if my WordPress site has the Rank Math PRO backdoor?

Look for admin accounts starting with “wpsupport_”, the file wp-includes/class-wp-cache-util.php, cron entries tagged “#ms6v46”, and outbound connections to rank1cdn.com. Investigate any suspicious findings and remove malicious files, and treat the site as compromised if you installed and activated 3.0.123 between 20:02 UTC on October 15 and 07:12 UTC on October 16.