Rank Math has disclosed a security incident in which attackers gained access to its systems and introduced malware into version 3.0.123 of its PRO plugin. The affected version was downloaded by a limited number of users over a period of just over 11 hours on October 15 and 16, 2026.
The malware could compromise websites where the plugin was activated. The incident affected Rank Math PRO users only, while users of the free Rank Math SEO plugin available on WordPress.org were unaffected. Rank Math has since released version 3.0.124 to replace the affected version.
Rank Math details signs of infection and recovery steps
Rank Math advises website owners to restore affected websites and databases from backups created before October 15, 2026. If no suitable backup is available, the advisory recommends removing the malware and checking for other unauthorized changes to the website and server.
The advisory identifies several indicators that website owners should look for when checking their sites. These include unfamiliar administrator accounts with usernames beginning with wpsupport_ followed by random characters, or email addresses ending in @wp-mail[.]net. It also identifies wp-includes/class-wp-cache-util.php as a file that does not belong to the legitimate WordPress core.
Other indicators include hidden PHP backdoors in must-use plugin directories, other plugin folders, and theme directories. Suspicious PHP code may contain base64_decode combined with XOR loops, the key xmmqhn, proc_open, or PHP-FPM socket code.
Admins should also check for .htaccess rules that allow .cache files to execute as PHP, .cache files containing PHP code, and system scheduled tasks marked with #ms6v46. Rank Math also recommends reviewing WordPress scheduled events, SSH authorized keys, running processes, and locations outside the website directory where the web server can write files.
To prevent the malware from recreating its backdoor, Rank Math instructs to delete the entire rank-math-pro plugin folder, remove malicious entries from the WordPress wp_options database table, and block outgoing connections to rank1cdn.com if their hosting provider or firewall supports it. The three database entries identified in the advisory are _uf6qdn2hmm, t8krdk990phb, and _np5pvf754c.
Alex Thomas of Wordfence wrote, “ If an affected copy of Rank Math SEO PRO 3.0.123 was active on your website, you should treat the website as compromised. Simply updating the plugin is not enough because the malware may have placed additional files, administrator accounts, or scheduled tasks elsewhere on the server.”
On the WordPress subreddit, a user wrote, “ Nothing in the changelog. No E-Mail from them. This is absolutely crazy stuff.”
Matt Mullenweg’s remarks on plugin security revisited
The incident also follows an earlier controversy over Rank Math’s Support Agent, which created WordPress Application Passwords when administrators opened its Help & Support panel. Rank Math removed the feature in version 1.0.277.2 after concerns were raised about how the credentials were created and transmitted.
Around the same time, Matt Mullenweg on the #plugin review Slack channel called for infrastructure security audits for plugins with administrative and update capabilities, claiming that Rank Math had recently been hacked. Rank Math had not suffered a breach at the time, but the current incident underscores the seriousness of the security concerns Mullenweg raised.