Skip to content
Hacker Posts

Rank Math PRO 3.0.123 shipped a self-restoring backdoor

Rank Math PRO 3.0.123 (CVE-2026-111862, CVSS 9.8) was served with a self-restoring backdoor during a 15–16 Oct window. Delete the plugin, clean the install, rotate everything.

Published 3 min read
cvewordpresssupply-chainrank-math

Copies of the paid Rank Math PRO SEO plugin for WordPress, version 3.0.123, were distributed with a backdoor during a narrow window on October 15–16, 2026. The malware re-creates itself on page load, so deleting a few files is not enough. If you installed or updated Rank Math PRO in that window, treat the site as compromised and work the checklist below. The clean release is 3.0.124.

The primary sources are Rank Math's own security notice (October 16) and Wordfence's advisory (October 17); The Hacker News corroborated both. The flaw is tracked as CVE-2026-111862, rated CVSS 9.8. This is the commercial PRO build distributed through rankmath.com — not the free plugin hosted on WordPress.org.

What's affected

Only Rank Math PRO 3.0.123 copies downloaded or delivered by update between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026. A 3.0.123 copy obtained before that window is outside the known-tainted set. Rank Math has emailed some affected users. Rank Math has not published package hashes for the clean and tainted builds, and wp plugin verify-checksums does not cover PRO plugins, so you cannot rely on a checksum to tell them apart.

What the backdoor does

Per Wordfence and Rank Math, the payload can rebuild its hidden backdoor whenever a visitor hits the site, so removing the plugin folder alone may not clear it. It may also drop PHP backdoors into other plugins, themes and the mu-plugins directory, create administrator accounts, alter .htaccess, and add scheduled tasks and SSH keys. Patchstack classifies it as a backdoor. No attacker has been named, and Rank Math has not said how the tainted build entered its distribution.

Indicators published by Rank Math and Wordfence:

Domain:          rank1cdn[.]com   (registered 2026-10-14 19:31 UTC)
wp_options keys: _uf6qdn2hmm, t8krdk990phb, _np5pvf754c
File:            wp-includes/class-wp-cache-util.php  (not a core file)
Admin accounts:  usernames beginning wpsupport_, or emails @wp-mail[.]net
Crontab tag:     #ms6v46
Markers:         base64_decode with XOR loops, key "xmmqhn", proc_open
.htaccess:       rules letting .cache files execute as PHP

Action checklist

  1. If you have a clean backup from before 20:02 UTC on October 15, restore it, scan it, rotate all credentials, then install 3.0.124 from your Rank Math account.
  2. Without a clean backup, delete the entire rank-math-pro folder (deactivating is not enough) and remove the three wp_options keys above.
  3. Block outbound connections to rank1cdn[.]com.
  4. Hunt for malicious PHP in mu-plugins, other plugin and theme folders, uploads, and Rank Math's includes directory. Check admin accounts, .htaccess, crontabs, scheduled events, and authorized_keys.
  5. Rotate everything: WordPress and database passwords, wp-config.php salts and keys, API/payment/SMTP keys, hosting, FTP/SFTP/SSH, and admin 2FA.
  6. Reinstall 3.0.124 last, straight from rankmath.com, and run a full scan. Wordfence warns a clean scan alone does not prove the site is clean.

Context

This is the latest WordPress plugin to be turned into a malware delivery channel through its own update path, not a code flaw an attacker found. We've covered the pattern before — most recently self-healing WordPress malware using blockchain C2 and the preauth RCE in WP2Shell / CVE-2026-63030. A self-restoring backdoor pushed through a legitimate commercial update is harder to clean than a one-off exploit: the trust is in the pipe, not a single file.

Related stories