# Rank Math PRO 3.0.123 Was Trojanized: Check Your Site, Then Restore

Page: https://hirantha.me/blog/rank-math-pro-30123-was-trojanized-check-your-site-then-restore
Published: 2026-10-21
Written by: hirantha.me Newsroom (AI-generated). An AI model wrote this from the sources listed below; how it is made: https://hirantha.me/about/newsroom
Topics: wordpress, rank math, supply chain attack, cve-2026-111862, website security

> Rank Math PRO 3.0.123, downloaded 15-16 Oct 2026, carried malware (CVE-2026-111862); updating to 3.0.124 does not clean an infected site.

If you run WordPress and bought Rank Math PRO, the first thing to check is not whether you are on the latest version but whether you ever installed version 3.0.123. A tampered copy of that release was served from the vendor's own website for roughly eleven hours, and for sites that activated it, updating does not undo the damage.

## What happened

Rank Math says some downloads of PRO 3.0.123 from its official site between 15 October 2026 at 20:02 UTC and 16 October 2026 at 07:12 UTC contained malware. The company removed the bad files on 16 October and shipped 3.0.124 as the clean replacement. The free Rank Math SEO plugin on WordPress.org is not affected.

Rank Math has not said how the attacker got into its distribution channel and has not given a number of affected sites. BleepingComputer reported that the company did not answer its questions on either point, and the vendor's own notice describes only "a limited number of users" in general terms.

The flaw is tracked as CVE-2026-111862 (Common Vulnerabilities and Exposures identifier), scored 9.8 out of 10 (critical) in the record published through CVE.org. NVD (the US National Vulnerability Database) analysis was still pending when the record was last checked.

## Status as of 21 October 2026

| Item | Value |
|---|---|
| Affected | Rank Math PRO 3.0.123, only copies downloaded in the window above |
| Fixed | Rank Math PRO 3.0.124 |
| Free plugin from WordPress.org | Not affected |
| CISA Known Exploited Vulnerabilities (KEV) catalog | Not listed (checked against the catalog file released 20 October 2026) |
| EPSS (Exploit Prediction Scoring System) | 0.7% probability of exploitation in the next 30 days, 53rd percentile (FIRST, 20 October 2026) |
| Public proof of concept | None found |

A low EPSS score and no KEV entry should not comfort anyone who actually installed the bad build. Those numbers estimate attacks against a flaw. Here the malicious code is already inside the package, so the question is simply whether you ran it.

## Who needs to act

Rank Math's guidance splits sites into three groups:

- **Activated 3.0.123 during the window:** treat the site as compromised.
- **Installed but never activated:** delete the files, install 3.0.124, run a security scan.
- **Downloaded only:** the vendor sees no sign of compromise from that alone.

Check your download history and the plugin's version on each site, including client sites and staging copies. A staging site that was cloned from production can carry the same files.

## Why updating is not a fix

Rank Math states that deactivating or updating the plugin does not necessarily remove the infection. The malware reaches out to the domain rank1cdn.com and recreates hidden backdoors when someone visits the infected site. It can also expose database credentials, API keys and other secrets the web server can read. So the cleanup has to cover the whole site and every credential it touched, not just the plugin folder.

## Indicators of compromise

These come from the vendor's incident notice. Run them even if the site looks normal.

- WordPress options named `_uf6qdn2hmm`, `t8krdk990phb` and `_np5pvf754c`
- A file at `wp-includes/class-wp-cache-util.php`, which is not a genuine core file
- Administrator accounts whose names start with `wpsupport_`, or whose email ends in `@wp-mail.net`
- Crontab entries tagged `#ms6v46`
- `.htaccess` rules that let `.cache` files run as PHP, and `.cache` files containing PHP
- PHP files inside `wp-content/uploads/`
- PHP using `base64_decode` with an XOR loop, the key `xmmqhn`, `proc_open` or PHP-FPM socket code

With WP-CLI (the WordPress command-line tool), a first pass looks like this:

```bash
# options planted by the malware (prints any that exist)
for o in _uf6qdn2hmm t8krdk990phb _np5pvf754c; do wp option get "$o" >/dev/null 2>&1 && echo "FOUND option $o"; done

# suspicious administrators
wp user list --role=administrator --fields=ID,user_login,user_email | grep -E 'wpsupport_|wp-mail\.net'

# fake core file and PHP hidden in uploads or .cache files
ls -l wp-includes/class-wp-cache-util.php
find wp-content/uploads -name '*.php'
grep -rl 'xmmqhn' wp-content wp-includes 2>/dev/null

# scheduled events, and the system crontab for the web user
wp cron event list
crontab -l | grep ms6v46
```

An empty result is not proof of a clean site. BleepingComputer also found a PHP file on VirusTotal that shares these markers and is described as a first-stage script able to run commands, change databases and look for cloud credentials and SSH keys. The outlet could not confirm it was spread through the plugin, and it is not in the vendor or Wordfence notices, so treat it as unverified.

## Cleanup order the vendor recommends

The preferred route is to restore files and database from a backup taken before 15 October 2026 at 20:02 UTC, scan, rotate credentials and then install 3.0.124.

Without a safe backup, do a manual cleanup in this order:

1. Delete the whole `rank-math-pro` folder (deactivation is not enough), delete the malicious option entries, and block outbound connections to rank1cdn.com.
2. Remove backdoor files, rogue admins, the fake core file, `.htaccess` rules, `.cache` files, malicious cron jobs and PHP in `uploads/`. Also look for unknown SSH keys in `authorized_keys` and crontabs of other system users.
3. Rotate everything: WordPress passwords, database credentials, security keys and salts, API and SMTP credentials, hosting, FTP and SSH logins, and two-factor settings.
4. Scan, verify core file checksums, watch outbound connections for a few days and check that removed files do not return.

## A side effect for free users

Rank Math also removed free accounts registered on rankmath.com between 13 and 16 October 2026 during a system refresh, and emailed those affected. Until the account is recreated and the site is reconnected under Rank Math SEO, Dashboard, Help, the Search Console and Analytics data, Keyword Rank Tracker and AI features stop working. SEO settings and content are unchanged.

## Decide today whether your site ran 3.0.123

By the end of today, confirm for every site you manage whether 3.0.123 was ever downloaded after 15 October 20:02 UTC and, if it was activated, move to the restore-and-rotate route rather than a plugin update. Sites that never touched that build need nothing beyond keeping PRO current.

## Questions

**Is the free Rank Math SEO plugin affected?**
No. Rank Math says the free plugin from WordPress.org is not affected; only PRO 3.0.123 copies downloaded from its site between 15 Oct 20:02 UTC and 16 Oct 07:12 UTC.

**Does updating to Rank Math PRO 3.0.124 remove the malware?**
Not on an infected site. The vendor says deactivating or updating does not necessarily remove it, because hidden backdoors can be recreated. Restore from a pre-15 October backup or clean manually, then rotate credentials.

## Sources

- [Rank Math PRO 3.0.123 security incident](https://rankmath.com/kb/pro-3-0-123-security-incident/), rankmath.com
- [WordPress SEO plugin Rank Math compromised to backdoor websites](https://www.bleepingcomputer.com/news/security/wordpress-seo-plugin-rank-math-compromised-to-backdoor-websites/), bleepingcomputer.com
- [CVE-2026-111862 record](https://www.thehackerwire.com/vulnerability/CVE-2026-111862/), thehackerwire.com
- [CISA Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), cisa.gov
- [EPSS data API](https://api.first.org/data/v1/epss?cve=CVE-2026-111862), api.first.org