Rank Math PRO Backdoor: Eleven Hours of Poisoned Downloads and What to Check

The Rank Math PRO backdoor shows how little a patched, well-run website can do when the poison arrives through the vendor’s own download page. For about eleven hours in mid-October, copies of Rank Math PRO 3.0.123 carried malware. Any site that installed one and switched it on should now be treated as compromised.

What happened with Rank Math PRO

Rank Math is a widely used SEO plugin for WordPress. Its paid edition, Rank Math PRO, is the one that was hit. According to the company’s own security notice, files downloaded between 20:02 UTC on 15 October and 07:12 UTC on 16 October 2026 contained malware. The company says the free version on WordPress.org is not affected.

Rank Math pulled the bad files and released a clean build, version 3.0.124. The notice says the tainted files “could compromise your website if the plugin was activated”. The word “activated” matters. A copy that was downloaded but never installed does not, by that alone, put a site at risk.

The Hacker News, which broke the story to a wide audience, points out a trap in the version numbers. The changelog dates 3.0.123 to 7 October, so the number alone does not tell you whether your copy is the bad one. What counts is when you got it.

Why the Rank Math PRO backdoor is hard to remove

The malware does not just sit in the plugin folder. Rank Math says it builds a hidden backdoor that rebuilds itself whenever someone visits the site. That is why the notice warns that deactivating the plugin is not enough.

The same notice lists what else the attackers may have left behind:

• new administrator accounts, with usernames starting wpsupport_ or email addresses ending @wp-mail.net
• a fake core file at wp-includes/class-wp-cache-util.php
• changes to .htaccess so that .cache files run as PHP
• scheduled tasks tagged #ms6v46
• calls out to a domain called rank1cdn.com

Patchstack tracks the issue as CVE-2026-111862, with a CVSS score of 9.8 and a High priority rating. It needs no login to abuse. Patchstack also says it cannot write a virtual patch for this one, because the compromise happened upstream, at the vendor.

A pattern, not a one-off

This is not the first premium plugin to be poisoned at the source this year. The Hacker News lists Nextend’s Smart Slider 3 Pro in April, where a backdoored update went out for about six hours, plus further incidents at ShapedPlugin, Awesome Motive and BdThemes. It says nothing publicly links the attackers.

The common thread is trust. Site owners keep plugins updated because that is the standard advice. Here, the update itself was the attack. Nobody has yet explained how the files got into Rank Math’s download system. It is also unclear whether automatic updates pushed them out. Until that is answered, the Rank Math PRO backdoor is a warning for every plugin vendor, not just this one.

What to do this week

Start by finding out whether you are in scope. Check the plugin list on every WordPress site you run or pay someone to run. Look for Rank Math PRO 3.0.123 and ask when it was installed.

• Installed and activated in the window: assume compromise, even after you move to 3.0.124.
• Installed but never activated: delete the plugin folder, install 3.0.124 and run a scan.
• Downloaded but never installed: the incident alone does not suggest a compromise.

Rank Math’s preferred fix is to restore a backup taken before 20:02 UTC on 15 October, scan the site, and rotate every credential. That means WordPress logins, database passwords, security keys and salts, API and SMTP keys, and hosting and SSH access. Then install 3.0.124, downloaded by logging in to rankmath.com directly. The company says it never emails download links, so treat any such message as a phish.

If you must clean by hand, delete the whole rank-math-pro folder first, remove the database entries the notice lists, and block the attacker’s domain. Only then start hunting for the rest.

The lesson for small teams

Be honest about the limits. You cannot audit a vendor’s build process from the outside.

What you can do is limit the damage. Keep tested, offline backups. Stage plugin updates on a copy of the site before they reach production, where you can. Watch for new admin accounts and outbound connections to unfamiliar domains.

A regular penetration test is a good way to find out how far an attacker could get from a single compromised plugin, and whether you would notice. Our software supply chain checklist covers the wider habits, and we have written before about WordPress malware that rebuilds itself after cleanup.