Malware Found in Rank Math SEO PRO Plugin Downloads
Rank Math has alerted users to malware present in some downloads of its SEO PRO plugin version 3.0.123, downloaded between October 15-16, 2026, potentially compromising affected websites.
Rank Math, a popular WordPress SEO plugin, has issued a critical security advisory concerning its SEO PRO version 3.0.123. The company disclosed that a subset of downloads or updates for this specific version, occurring between October 15, 2026, at 20:02 UTC and October 16, 2026, at 07:12 UTC, contained malicious code. Websites that activated this compromised version are advised to treat their entire site as compromised, as the malware could have established persistent backdoors, created unauthorized administrator accounts, and exposed sensitive credentials.
The vulnerability, tracked as CVE-2026-111862, carries a critical CVSS score of 9.8. According to Wordfence Intelligence, the embedded malicious code in Rank Math SEO PRO 3.0.123 could lead to severe compromise. The malware is capable of establishing persistent access, communicating with a command-and-control server at rank1cdn[.]com, and recreating hidden backdoors upon page visits. Furthermore, it poses a significant risk of exposing WordPress user credentials, database connection details, API keys, and other secrets accessible to the web server environment.
Rank Math has identified several indicators of compromise, including malicious entries in the WordPress wp_options database table (specifically _uf6qdn2hmm, t8krdk990phb, or _np5pvf754c), hidden PHP backdoors, the creation of unauthorized administrator accounts, a fake WordPress core file, PHP executable files disguised as cache files, and a system cron marker. The company emphasizes that simply having version 3.0.123 installed does not automatically mean a site is compromised; the incident is limited to those who downloaded or updated within the specified timeframe.
To address the threat, Rank Math has removed the malicious files and released a clean version, 3.0.124. However, simply updating the plugin is insufficient if an affected copy was activated. Rank Math strongly recommends that affected websites undergo a full recovery process. This typically involves restoring the site and its database from a clean backup created before the compromise window. Following restoration, a thorough security scan is advised, along with the immediate replacement of all passwords and sensitive credentials.
For website owners who activated an affected copy of version 3.0.123 but lack a suitable backup, Rank Math advises a manual cleaning process, preferably performed by a security professional. Key steps include deleting the entire rank-math-pro plugin folder (deactivation is not enough), removing the malicious wp_options entries, and blocking outbound connections to rank1cdn[.]com. After these measures, it's crucial to reinstall WordPress core, plugins, and themes from trusted sources.
Rank Math also stresses the importance of changing a wide range of credentials, including WordPress user passwords, database credentials, WordPress security keys and salts, payment and email service credentials, API keys, hosting control panel credentials, and any FTP, SFTP, or SSH credentials that might have been exposed. Reviewing two-factor authentication settings for all administrator accounts is also a critical step in securing the environment.
If users downloaded version 3.0.123 but did not install or activate it, Rank Math states there is no indication of compromise. Similarly, if version 3.0.123 was installed but never activated, the recommendation is to delete the affected plugin files and install version 3.0.124. Rank Math has reportedly identified and may have directly notified users who downloaded an affected copy, urging them to follow its specific recovery instructions.