Rank Math PRO WordPress SEO Plugin Compromised to Backdoor Websites

Compromised Rank Math PRO Downloads Planted a Self-Restoring Backdoor on WordPress Sites

Rank Math, the WordPress SEO plugin vendor owned by MyThemeShop, has confirmed that some copies of Rank Math PRO — the plugin's paid add-on — distributed directly from the vendor's own website carried malware capable of fully backdooring any WordPress site that activated it. Rank Math says the tainted files were live for roughly 11 hours, between 20:02 UTC on October 15, 2026 and 07:12 UTC on October 16, 2026, affecting anyone who downloaded or auto-updated to version 3.0.123 in that window. The vendor pulled the affected files and shipped a clean version 3.0.124 once the compromise was discovered. Wordfence has assigned the incident CVE-2026-111862 with a CVSS score of 9.8 (Critical), and Patchstack notes that because the compromise occurred on Rank Math's own build and distribution infrastructure rather than in a code vulnerability, no firewall rule can mitigate it — remediation requires manual cleanup on every affected site.

Incident Details

How the Backdoor Works

A tainted build inside the official distribution pipeline

This was not a vulnerability researchers found in Rank Math's code — it was a supply-chain compromise of the vendor's own download and update infrastructure. For roughly 11 hours, anyone who downloaded Rank Math PRO 3.0.123 directly from rankmath.com, or received it as an automatic update, got a build laced with malicious PHP. Rank Math has not disclosed how the tainted build entered distribution or the number of sites affected, and BleepingComputer reports that the attacker and the intrusion method into Rank Math's own systems remain undisclosed.

First-stage deployment and a non-core file masquerading as WordPress

Once activated, the plugin dropped a first-stage script (reported in the wild as _cache-preloader-fff033 (1).php) that in turn wrote a persistent backdoor to wp-includes/class-wp-cache-util.php — a filename designed to look like a legitimate WordPress core file even though no such file exists in core. Researchers also found copies of the malicious code planted inside wp-content/mu-plugins/, inside other installed plugins' folders, and inside theme inc/, includes/, and lib/ directories, along with .htaccess rewrites that let .cache-extension files execute as PHP.

A backdoor built to survive cleanup

The defining feature of this payload is persistence: the backdoor recreates itself whenever a visitor loads the infected site, so deleting the obvious malicious files without first neutralizing the mechanism that regenerates them does not clean the infection. The malware also wrote marker entries into the WordPress database — reported as _uf6qdn2hmm, t8krdk990phb, and _np5pvf754c — plus a cron job tagged #ms6v46 to maintain scheduled re-infection. The malicious PHP itself obfuscates its logic with base64_decode wrapped in an XOR loop using the key xmmqhn, and uses proc_open and PHP-FPM socket calls to execute attacker-supplied commands.

Command-and-control and account takeover

The backdoor phones home to rank1cdn[.]com, a domain registered just one day before the attack window began — a strong indicator the campaign was planned in advance. On top of the file-level backdoor, the attackers created rogue WordPress administrator accounts with usernames prefixed wpsupport_ and email addresses ending in @wp-mail[.]net, giving them a second, independent path back into compromised sites even if the PHP backdoor is later found and removed.

Who was — and wasn't — affected

Only Rank Math PRO, the paid add-on distributed from Rank Math's own site and customer accounts, carried the malware. The free Rank Math SEO plugin available on the official WordPress.org repository, used on more than 4 million websites, was not part of this incident. Site owners who downloaded 3.0.123 but never activated it are not considered compromised by Rank Math's own guidance, though the vendor still recommends deleting the file and reinstalling 3.0.124 from a verified source.

Impact Assessment

Recommendations

For site owners who activated Rank Math PRO 3.0.123

• Assume full compromise — do not treat this as a simple plugin update. Restore the entire site and database from a clean backup taken before October 15, 2026, 20:02 UTC if one is available.
• If restoring from backup isn't possible, delete the entire rank-math-pro plugin folder outright; deactivating the plugin in wp-admin is not sufficient.
• Search for and remove the fake core file wp-includes/class-wp-cache-util.php, any suspicious files in wp-content/mu-plugins/, other plugin folders, and theme inc/, includes/, and lib/ directories, plus any .htaccess rules that let .cache files execute as PHP.
• Remove the malicious database option entries (_uf6qdn2hmm, t8krdk990phb, _np5pvf754c) and any cron entries tagged #ms6v46 before re-scanning, since leaving them in place can let the infection regenerate.
• Delete any administrator accounts with usernames starting wpsupport_ or emails ending @wp-mail[.]net.
• Rotate every credential the web server could reach: WordPress admin passwords, database credentials, WordPress secret keys/salts, SSH keys, and API keys for AWS, Google Cloud, Azure, and Cloudflare.

For hosting providers and security teams

• Block outbound connections to rank1cdn[.]com at the firewall and DNS layer across managed WordPress hosting environments.
• Scan hosted sites for the file and database indicators above rather than relying solely on plugin-version checks, since updating to 3.0.124 does not remove artifacts the malware already planted.
• Flag any WordPress installation showing the wpsupport_ / @wp-mail[.]net account pattern for manual incident response.
• Treat this as a reminder that vendor-direct plugin downloads are not inherently safer than marketplace-distributed ones — verify checksums where vendors publish them, and monitor outbound traffic from WordPress hosts for anomalies.

For general WordPress site owners

• Confirm which Rank Math PRO version is currently installed; anything other than 3.0.124 (or a version released after it) installed via an update during the October 15–16 window warrants a full check.
• If you only downloaded, but never installed or activated, the affected file, delete it and reinstall 3.0.124 from your Rank Math account rather than assuming it's safe.
• Run a reputable WordPress malware scanner after any plugin incident like this one, even if your site "looks fine" — this backdoor was specifically built to hide and regenerate.
• Keep offline, versioned backups taken before any plugin update, so a compromised vendor release doesn't also wipe out your recovery point.

Key Takeaways

1. Rank Math PRO v3.0.123, distributed directly from Rank Math's own site and update channel, carried malware for roughly 11 hours (October 15, 20:02 UTC – October 16, 07:12 UTC).
2. The free Rank Math SEO plugin on WordPress.org, used on more than 4 million sites, was never affected — only the paid PRO add-on from Rank Math's own distribution.
3. The payload drops a self-restoring backdoor (wp-includes/class-wp-cache-util.php), creates rogue wpsupport_ / @wp-mail[.]net admin accounts, and phones home to rank1cdn[.]com, a domain registered one day before the attack.
4. Wordfence tracks the incident as CVE-2026-111862 with a CVSS score of 9.8 (Critical); Patchstack notes no firewall rule can mitigate a compromise of the vendor's own build pipeline.
5. Updating to the clean 3.0.124 release does not remove backdoor files, rogue accounts, or cron jobs already planted on an activated, compromised site — full incident response is required.
6. Any site that activated the tainted build should rotate all credentials reachable by the web server, including cloud provider API keys (AWS, Google Cloud, Azure, Cloudflare) and SSH keys, not just WordPress passwords.

Sources

• WordPress SEO plugin Rank Math compromised to backdoor websites — BleepingComputer
• Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor — The Hacker News
• PSA: Malware Found in Some Rank Math SEO PRO 3.0.123 Downloads — Wordfence
• Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code — Patchstack