Some Rank Math PRO 3.0.123 Downloads Carried Malware for 11 Hours, and Updating Will Not Clean an Infected Site

Rank Math says some copies of its PRO plugin for WordPress contained malware. According to the company’s security notice, the affected files went to people who downloaded version 3.0.123 between 20:02 UTC on Thursday, October 15 and 07:12 UTC on Friday, October 16, a window of 11 hours and 10 minutes, and anyone who activated an affected copy should treat the website as compromised. Rank Math has released a clean version, 3.0.124, but updating to it is not a cleanup. Wordfence, which published its own alert early on Saturday, October 17, says: “Simply updating the plugin is not enough because the malware may have placed additional files, administrator accounts, or scheduled tasks elsewhere on the server.”

Wordfence lists the problem as CVE-2026-111862, rated 9.8 (Critical), and gives the researcher as “Unknown.” The notice does not say how the malicious files got into what people downloaded, how many people received them, or what separates an affected copy of 3.0.123 from a clean one. Rank Math’s own changelog suggests the version number is not the answer to that last question.

What Rank Math says happened

The notice, which carries a publication timestamp of 20:32 UTC on October 16, says the company “recently identified a security issue affecting a limited number of users who downloaded Rank Math PRO v3.0.123” in that window, and that the affected plugin files “contained malware that could compromise your website if the plugin was activated.” Rank Math says it removed the files and released 3.0.124. It does not say how many users a “limited number” means. It does say it has records showing who downloaded an affected copy, and that anyone it notified should follow the recovery steps “even if you’re now running a different version.”

Timeline, in UTC

The version number cannot say which copy you have

Rank Math’s public changelog dates PRO v3.0.123 to October 7. The entry is an ordinary record on rankmath.com, and its REST interface shows it was published at 09:08 UTC that day and last modified at 09:11. The download window the company describes opened more than eight days later. The copies it calls affected therefore carried a version number that its own changelog had announced more than a week earlier.

The notice limits the problem to that window, which implies that copies of 3.0.123 fetched before it are a different build, but the notice does not describe the two builds or say how the files were swapped. The practical consequence is that the Plugins screen cannot settle the question. Wordfence says: “Version 3.0.123 by itself does not prove that a website was compromised.” What decides it is when the copy was downloaded or installed through an update.

The changelog entry for 3.0.124, published at 15:24 UTC on October 16, lists the same two bug fixes as 3.0.123 and does not mention the incident. The notice is where Rank Math explains it.

What the malware does, and what to look for

Wordfence’s summary of Rank Math’s account says the malware “may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server.” Rank Math’s notice says the malware can rebuild its hidden backdoor whenever someone visits the site, and tells owners to assume that credentials and secrets the site could reach may have been exposed. Neither the notice nor Wordfence’s alert includes file hashes or a code analysis. The indicators below come from Rank Math’s notice.

Rank Math also tells owners to review WordPress scheduled events, SSH authorized_keys files, other system users’ scheduled tasks, running processes and any place outside the site directory where the web server can write. Wordfence adds a caution about the whole list: “Their absence does not, by itself, prove that a website is clean.”

What the registry and checksum data show

The registry’s RDAP record for rank1cdn.com says it was registered at 19:31 UTC on Wednesday, October 14, through NiceNIC International Group, with Cloudflare name servers, and last changed 13 minutes later. That is about 24 and a half hours before the download window opened. We read that as a domain set up for this operation, though the record does not show who registered it. The email domain in Rank Math’s list, wp-mail.net, is older: its record shows registration in June 2022, so a recent registration date will not help anyone spot it.

Rank Math suggests running wp plugin verify-checksums --all after cleanup, with a caveat: checksum verification “may not be available for every plugin, particularly premium plugins.” We checked the lookup WP-CLI uses, which builds a URL of the form downloads.wordpress.org/plugin-checksums/PLUGIN/VERSION.json. For the free plugin at 1.0.280 it returns a checksum file (HTTP 200). For rank-math-pro at 3.0.123 it returns 404. In WP-CLI’s checksum command, a failed lookup produces a warning and the plugin is skipped, so the command has nothing to compare this plugin against. The reference copy is the one in a Rank Math account.

The notice names only PRO. WordPress.org lists the free Rank Math plugin, which has 4 million or more active installs, at version 1.0.280, last updated October 6, before the window opened. As for the CVE, neither the NVD’s API nor CVE.org’s record service returned a record for CVE-2026-111862 when we checked at about 10:10 UTC on October 17, so a search by ID will currently find only Wordfence’s page.

What the notice leaves open

Rank Math has not said how the malicious files ended up in what people downloaded, whether the cause was its build process, its servers or an account, or how many users received an affected copy. It describes copies “downloaded or updated” in the window without saying how many arrived through automatic updates. It notes that some users “may be unable to log in and may need to reset their account password,” without saying why. And it says only that the team is “taking steps to reduce the risk of similar incidents in the future.” The notice does not attribute the incident to any group.

What Rank Math tells owners to do

The order matters, because the malware “can recreate its hidden backdoor whenever someone visits the website.” These are Rank Math’s steps, in its sequence:

1. Work out when your copy of 3.0.123 arrived. The notice does not describe a copy fetched outside the window as affected. If you cannot tell, Rank Math says to contact its support team.
2. The preferred recovery is to restore the site and database from a backup made before 20:02 UTC on October 15 (16:02 EDT), scan with a reputable security tool, change all credentials, and only then install 3.0.124 from your Rank Math account.
3. With no clean backup, do three things before touching anything else: delete the whole rank-math-pro folder (deactivating is not enough), delete the three wp_options rows listed above, and block outbound connections to rank1cdn[.]com if your host or firewall allows it. Then look for the other changes in the table.
4. Replace every credential the site could reach: WordPress passwords, database credentials, the security keys and salts in wp-config.php, payment, email and API keys, hosting control panel, FTP, SFTP and SSH credentials, and review two-factor settings for administrators. Rank Math says this is essential even after a restore from backup.
5. Verify: run wp core verify-checksums, scan again, watch outbound connections, and check that removed files do not return. Files that come back mean the cleanup is incomplete.
6. Download 3.0.124 only by logging in at rankmath.com directly. Rank Math says it “will never send login or download links by email” and that unsolicited password-reset or download messages should be treated as suspicious.

Why it matters beyond one plugin

A premium plugin is delivered by its vendor, not by WordPress.org, and the checksum data above shows what that costs a site owner: the WordPress.org lookup has nothing to compare a copy against, and, as the 3.0.123 label shows, the version number cannot stand in for it. The shape is familiar. Our report on the poisoned Tensorlake SDK described a malicious release that reached npm through the project’s own release workflow with valid provenance, and Cloudflare’s EmDash registry, which we covered on September 28, is built on signed AT Protocol records.

The behavior Rank Math describes, a backdoor rebuilt when someone visits the site, is why its cleanup order matters. Wordfence documented a different WordPress backdoor in September that rewrote itself from a database backup after deletion. Nothing published so far links the two.

We read Rank Math’s notice at about 10:10 UTC on October 17. Its HTTP Last-Modified header says 06:29 GMT that day, so its wording may have changed since the 20:32 UTC publication timestamp. We read Wordfence’s alert through its RSS feed. We also used Rank Math’s changelog page and the public records behind its entries, the Verisign RDAP records for both domains, the NVD API and CVE.org’s record service, WordPress.org’s plugin API and checksum files, and the WP-CLI source. We did not obtain or analyze the malware and did not test any website. At about 10:10 UTC the recent feeds of BleepingComputer, The Hacker News, SecurityWeek, Sucuri, Patchstack, WP Tavern, The Register and Search Engine Journal did not mention the incident, so Wordfence’s alert, which relays Rank Math’s account, is the only third-party source we found. Weekdays and durations are our own arithmetic from the timestamps.