Some copies of Rank Math SEO PRO, a premium SEO plugin for WordPress, shipped with malware baked in. Rank Math says the poisoned build was version 3.0.123, and only copies downloaded or installed through an update between October 15, 2026 at 20:02 UTC and October 16 at 07:12 UTC are affected. If one of those copies was active on a site, the site should be treated as compromised, according to a public service advisory from Wordfence written by Alex Thomas, which relays Rank Math's own security notice.
That last part matters. Updating to the clean 3.0.124 release replaces the plugin, but it does not remove whatever the malware has already dropped elsewhere on the server.
A supply-chain hit, not a coding bug
Wordfence tracks the incident as CVE-2026-111862, rated 9.8 (Critical), and describes it as a supply-chain compromise of a subset of 3.0.123 packages rather than a flaw in the plugin's code. Per Rank Math, the malware can establish persistent access, talk to rank1cdn[.]com, recreate hidden backdoors whenever the site is visited, and expose anything the web server can read: WordPress and database credentials, API keys and other secrets. The attacker may also have left extra administrator accounts, scheduled tasks or server-level changes behind.
Having 3.0.123 installed is not proof of compromise on its own. Rank Math limits the incident to the stated window and says it has records of who downloaded an affected copy. If a site downloaded the build but never installed it, the company sees no sign of compromise from this incident alone. If it was installed but never activated, delete the plugin files, install 3.0.124 and run a scan.
Restore from before October 15, then rotate everything
For sites where an affected copy was activated, Rank Math recommends restoring files and database from a clean backup made before October 15 at 20:02 UTC, scanning, replacing every credential the site could reach, and only then installing 3.0.124 directly from a Rank Math account. Without a usable backup, the order of manual cleanup is important, because the malware rebuilds itself on page visits:
- Delete the whole rank-math-pro plugin folder. Deactivating it is not enough.
- Delete wp_options rows named _uf6qdn2hmm, t8krdk990phb and _np5pvf754c.
- Block outbound connections to rank1cdn[.]com where the host or firewall allows it.
- Then hunt for the remaining indicators and reinstall WordPress, plugins and themes from trusted sources.
Credentials to change include WordPress passwords, database credentials, security keys and salts, payment and email service credentials, API keys, hosting panel logins and FTP, SFTP or SSH credentials. Rank Math says it will not email login or download links, so treat any such message as suspicious.
Signs the backdoor is still there
- Outbound traffic to rank1cdn[.]com
- Unknown admin users starting with wpsupport_, or accounts with an email address ending in [at]wp-mail[.]net
- A file at wp-includes/class-wp-cache-util.php, which is not part of WordPress core
- Unexpected PHP in wp-content/mu-plugins/, other plugins' folders, theme inc/, includes/ or lib/ folders, Rank Math's includes/ folder, or uploads
- PHP using base64_decode with XOR loops, the key xmmqhn, proc_open or PHP-FPM socket code
- .htaccess rules letting .cache files run as PHP, or .cache files containing PHP
- Web server user cron entries carrying the marker #ms6v46
After cleanup, run wp core verify-checksums and wp plugin verify-checksums --all, compare premium plugins against a fresh copy from the developer, and watch for removed files reappearing. If they come back, the cleanup is not finished.
WordPress has seen this pattern before, including when plugins were hijacked without changing their code. The lesson is the same as with the AOMEI update hijack this week: the update channel is a trust relationship, and for eleven hours this one delivered an attacker's code to sites that did exactly what they were told.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.