What happened with Rank Math SEO PRO 3.0.123
Rank Math disclosed that a subset of its SEO PRO 3.0.123 packages contained malware. Security people call this a supply-chain compromise: the harmful code arrived inside the official plugin download, not through a break-in on your server. Wordfence relayed the details in its public notice, listing the issue as CVE-2026-111862 with a critical rating of 9.8. Rank Math removed the affected files and released 3.0.124 as the clean replacement.
Seeing 3.0.123 in your plugin list does not, by itself, mean your site was hit. Rank Math limits the incident to copies obtained during the stated window, so the date your copy arrived matters more than the version number. Once an affected copy was activated, though, the malware can set up persistent access, contact rank1cdn[.]com, recreate hidden backdoors when pages load, and expose passwords, database details, API keys and other secrets the web server can read.
Work out when your copy of 3.0.123 arrived
Start with timing. The affected period ran from 20:02 UTC on 15th October 2026 to 07:12 UTC on 16th October 2026, which is 21:02 to 08:12 UK time, as British Summer Time was still in force. Rank Math says it holds records of who downloaded an affected copy. If you received a notice from Rank Math, follow its instructions even if your site now runs a different version.
Once you know the timing, match your site to one of three situations. When you cannot pin down the date, take the stricter path: guessing wrongly in the other direction leaves a backdoor running.
- Installed and activated during the window: treat the site as compromised and complete the full recovery in the next section.
- Installed but never activated: delete the plugin files, install 3.0.124 from your Rank Math account and run a security scan.
- Downloaded but never installed or activated: Rank Math says the incident alone gives no indication your site was compromised. Use 3.0.124 for any future install.
Recovering a site that ran the Rank Math SEO PRO 3.0.123 malware
Rank Math's preferred route is to restore both the files and the database from a clean backup made before 20:02 UTC on 15th October 2026. After the restore, scan the site, replace your credentials as described below, then install 3.0.124 directly from your Rank Math account. A backup taken after that moment may already contain the malware, so check its date before relying on it.
Without a suitable backup, the site needs cleaning by hand, and the order of work matters because the malware can rebuild its backdoor whenever someone visits a page. Switch off that rebuilding mechanism with the first three steps before removing anything else.
Our write-up on self-healing malware shows how code stored in the database can bring infected files back after a file-only clean-up. If editing database tables and server files feels unfamiliar, hand the job to an experienced security professional or your hosting provider.
- Delete the entire rank-math-pro plugin folder. Deactivating the plugin is not enough.
- In the wp_options database table, delete any row whose option_name is _uf6qdn2hmm, t8krdk990phb or _np5pvf754c.
- Block outgoing connections to rank1cdn[.]com through your hosting provider or firewall, if either supports it.
- Check the rest of the site and server for the signs listed further down, then reinstall WordPress, plugins and themes from trusted sources where appropriate.
Replace every credential the site could reach
A restore removes the malware, but it cannot take back secrets that were already read from the server. Rank Math says to change passwords even after a clean restore, covering everything the website had access to.
Once those are changed, open Users > All Users, review two-factor authentication settings for administrator accounts, and investigate any administrator you do not recognise.
- WordPress passwords for every account, plus the security keys and salts in wp-config.php
- Database credentials, with wp-config.php updated to match
- Hosting control panel, FTP, SFTP and SSH logins
- Payment and email service credentials, and any API keys stored in plugins or settings
Signs to look for on an affected site
Rank Math published a set of indicators. Finding any of them means the site needs investigation. Finding none does not prove the site is clean, because an attacker can leave changes outside this list.
Rank Math also recommends reviewing WordPress scheduled events, SSH authorised keys, scheduled tasks for other system users, running processes and any writable locations outside the site folder. Most of those checks need server access, so ask your host for help if you lack it.
- Unknown administrator usernames beginning with wpsupport_, or accounts using an email address ending in @wp-mail[.]net
- A file at wp-includes/class-wp-cache-util.php, which Rank Math says is not a genuine WordPress core file
- Unexpected PHP files in wp-content/mu-plugins/, the uploads directory, other plugins' folders, the Rank Math includes/ folder, or the inc/, includes/ and lib/ folders of non-default themes
- Rules in a .htaccess file that let .cache files run as PHP, and .cache files containing PHP code
- System scheduled tasks for the web server user containing the marker #ms6v46
- Outgoing connections to rank1cdn[.]com
Verifying the clean-up and installing 3.0.124
If your host offers SSH access with WP-CLI, the command-line tool for WordPress, you can compare files against official copies. Run wp core verify-checksums for WordPress core and wp plugin verify-checksums --all for plugins. Checksums are not available for every premium plugin, so compare those files against a fresh copy downloaded from the developer.
Read a clean checksum result as an observation rather than proof. Matching files show that core and the checked plugins are unchanged, yet they reveal nothing about the database, extra files elsewhere or server-level tasks. Keep an eye on outgoing connections and confirm that removed files stay gone. When suspicious files reappear, the clean-up is incomplete.
To get 3.0.124, go to rankmath.com yourself and sign in. Rank Math says it will not email login or download links, so treat any unexpected message offering one as suspicious. Our guide to updating plugins safely covers backups and post-update checks for the install itself.
Getting help with a compromised site
Supply-chain incidents give owners no warning, since the code arrives through a trusted update. The BdThemes plugin supply chain attack in August 2026 followed a similar route, with hidden administrator accounts created through compromised plugins.
If Google or browsers now show warnings for your site, or you would rather not touch the database yourself, BugShield can remove malware and restore listings as a fixed-price job.
Sources
Rank Math SEO PRO 3.0.123 malware FAQs
Does updating to Rank Math SEO PRO 3.0.124 make my site safe?
Not if an affected copy of 3.0.123 was active. Version 3.0.124 replaces the plugin package, but it does not remove files, administrator accounts or scheduled tasks the malware created elsewhere. Those sites still need a full recovery and new credentials.
I run 3.0.123 but installed it before the evening of 15th October. Am I affected?
Rank Math limits the incident to copies downloaded or updated between 20:02 UTC on 15th October 2026 and 07:12 UTC on 16th October 2026. The version number alone is not evidence of compromise. If Rank Math contacted you, follow its instructions regardless.
Is deactivating Rank Math SEO PRO enough to stop the malware?
No. Rank Math says to delete the entire rank-math-pro plugin folder, then remove the three listed wp_options entries and block rank1cdn[.]com before cleaning anything else.
Can I restore from a backup made on 16th October?
Only a backup created before 20:02 UTC on 15th October 2026 counts as clean. Later backups may contain the malware. Restore both files and database, then change every credential the site could reach.
My security scan found nothing. Is my site clean?
A clear scan is a good sign, not proof. The absence of indicators does not show that a site is clean. Keep monitoring outgoing connections and confirm that removed files do not return.