Rank Math PRO's compromised update: why installing 3.0.124 won't clean your WordPress site

TechScripts Nepal · Kathmandu · October 26, 2026 · 5 min read

Between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026, some downloads of Rank Math PRO, a popular premium SEO plugin for WordPress, contained malware. Rank Math says it removed the affected files and released a clean version, 3.0.124. But the vendor's own guidance contains the line that matters most to anyone affected: updating the plugin does not remove the damage it already did.

What happened

According to Rank Math's security notice, a limited number of users who downloaded Rank Math PRO v3.0.123 during that window received files containing malware that could compromise a site once the plugin was activated. The company doesn't say how many people that is. The free Rank Math SEO plugin distributed through WordPress.org was not affected.

There's one confusing detail. The plugin's changelog dates version 3.0.123 to October 7, so the clean and the malicious copies shared the same version number. Seeing "3.0.123" in your dashboard doesn't prove you're infected, and seeing "3.0.124" doesn't prove you're clean. What matters is when the files were downloaded and whether they were activated.

What the malware did

Rank Math's notice doesn't describe the payload in detail, but the indicators it lists point to a thorough compromise rather than a simple defacement:

• A persistent backdoor that rebuilds itself whenever the site is visited, so deleting a single file doesn't remove it.
• Rogue administrator accounts.
• A fake WordPress core file, wp-includes/class-wp-cache-util.php, that doesn't belong there.
• Altered .htaccess rules that let files with a .cache extension run as PHP.
• Malicious scheduled tasks in WordPress's cron system (the notice mentions entries tagged #ms6v46) and WP-CLI scheduled events.
• Outbound connections to a domain, rank1cdn.com.

This is why a plugin update isn't a cleanup. The update replaces the plugin's folder, while the backdoor, accounts, and scheduled tasks live elsewhere on the site and the server.

Are you affected?

Rank Math's guidance breaks it into three cases:

• You installed and activated v3.0.123 during the window. Treat the site as compromised and follow the full recovery below.
• You installed it but never activated it. Delete the affected files, install v3.0.124, and run a security scan.
• You downloaded it but never installed or activated it. The notice says the incident alone doesn't indicate a compromise. Contact support if you're unsure.

Check the installed version under Plugins in your WordPress admin, and compare it with when you updated, using your hosting provider's logs or backups if you need to establish the timing.

Recovery, in order

The order below follows Rank Math's notice, and it matters. Cleaning up before stopping the rebuild mechanism just means the backdoor comes back.

1. Prefer a clean backup. The recommended route is restoring the site and database from a backup made before 20:02 UTC on October 15. If you can't, you'll be cleaning by hand.
2. Stop the rebuild mechanism first. Delete the rank-math-pro folder entirely (deactivating isn't enough), remove the malicious entries from the wp_options table, and block rank1cdn.com if you can.
3. Remove everything else the malware placed. Look for unknown PHP files, unfamiliar administrator accounts, the fake core file named above, suspicious .htaccess rules and .cache files, malicious cron and WP-CLI entries, and PHP files in the uploads directory. Check for server-level changes too, such as added SSH keys and other users' scheduled jobs. Reinstall WordPress core, plugins, and themes from official sources.
4. Rotate every credential. Change WordPress passwords, database credentials, the security keys and salts in wp-config.php, API keys, SMTP credentials, and hosting, FTP/SFTP, and SSH access. Rank Math says this is essential even if you restored from a backup. Review two-factor authentication on admin accounts.
5. Verify. Run a security scan, check core and plugin file checksums where available, watch outbound connections, and make sure removed files don't come back.
6. Install the clean plugin last. Download v3.0.124 directly from rankmath.com after recovery.

There was also a side effect for Rank Math account holders: the company says a system refresh removed free Rank Math accounts registered between October 13 and 16, and affected users were emailed. SEO settings and content on sites weren't affected, but those accounts need to be recreated and sites reconnected.

What this says about plugin supply chains

WordPress plugins are code that runs with the same privileges as the site itself. A premium plugin delivered from the vendor's own servers is trusted by default: it's installed from a trusted source, updated automatically, and often never reviewed. That's convenient, and it's exactly what makes a compromised update so effective. It's the same pattern we looked at in the MALFEX npm campaign and the LiteLLM compromise, in a different ecosystem.

A few habits reduce the exposure:

• Keep tested, recent backups stored somewhere the site can't overwrite. The backup you can restore from is what turns this from a rebuild into an afternoon's work.
• Stage updates before production when you can, and watch for new admin users, new scheduled tasks, and unexpected outbound connections afterward.
• Limit what the web server can do. Block PHP execution in the uploads directory and run with least privilege so a backdoor has less to work with.
• Keep a short list of every plugin and where it comes from, so that when an incident like this is announced, you can answer "are we affected?" in minutes.

WordPress-based sites often sit at the awkward edge of a company's IT: important to the business, owned by marketing, and maintained by whoever has time. If that describes yours, a technical partner can take over the unglamorous parts, such as an update and backup routine, a plugin inventory, and a tested recovery plan, so a vendor's bad weekend doesn't become yours. That's the sort of work our team does, and the same discipline applies to the PHP runtime underneath, as we covered in the PHP2Shell flaws.