Rank Math SEO PRO 3.0.123 Malware (CVE-2026-111862): How to Check and Clean Your Site

Some copies of Rank Math SEO PRO 3.0.123 shipped with malware. This was not a coding bug that an attacker had to find and exploit. The malicious code arrived inside the plugin package itself, delivered through Rank Math's own download and update channel for about eleven hours on October 15 and 16, 2026. It is tracked as CVE-2026-111862 and rated 9.8 (Critical), and Patchstack classifies it as a backdoor.

The awkward part is that the version number does not tell you whether you were hit, and the clean update does not undo the damage on a site that ran the bad copy. This guide explains how to work out which situation you are in, what to look for, and how to clean up in the order that actually works, using Rank Math's own security notice as the reference throughout.

TL;DR

• Only Rank Math SEO PRO 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC are affected. Seeing 3.0.123 in your plugin list is not proof of compromise.
• If an affected copy was activated, treat the whole site as compromised. Updating to 3.0.124 replaces the plugin but leaves behind any files, admin accounts, and scheduled tasks the malware created.
• The best fix is restoring files and database from a backup made before October 15 at 20:02 UTC, then rotating every credential the site could read.
• Without a clean backup, clean by hand in a fixed order: delete the whole rank-math-pro folder, delete three specific wp_options rows, block outbound traffic to rank1cdn[.]com, and only then hunt for leftovers.
• Download 3.0.124 only by going to rankmath.com yourself and logging in. Rank Math says it will never email login or download links.

What happened to Rank Math SEO PRO 3.0.123?

Rank Math published a security notice on October 16, 2026 saying that a limited number of users who downloaded Rank Math PRO 3.0.123 in a specific window received plugin files containing malware. According to the notice, those files could compromise a website once the plugin was activated. Rank Math removed the affected files and released 3.0.124 as the clean replacement.

Wordfence published the advisory as CVE-2026-111862 the following morning, describing it as a supply-chain compromise affecting a subset of 3.0.123 packages. Patchstack lists the same CVE with the note that the attack targeted Rank Math's own infrastructure, which is why it could not publish a firewall rule for it. There is no request pattern to block when the harmful code is the plugin.

Rank Math has not said how its packages were tampered with. The notice says the team is "taking steps to reduce the risk of similar incidents in the future" and stops there. Neither Wordfence nor Patchstack credits a researcher.

How the timeline fits together

One detail matters more than it looks. According to Rank Math's PRO changelog, version 3.0.123 was released on October 7, 2026. The malicious window opened eight days later. So 3.0.123 was a normal release for over a week, and then, for about eleven hours, some of the copies being served were not the real thing.

Two practical consequences follow. First, a site that updated to 3.0.123 between October 7 and the evening of October 15 received a clean copy, according to Rank Math. Second, if a site auto-updated overnight in Europe or during the afternoon and evening in the Americas on October 15, it sits squarely in the window.

Here is the window converted into common time zones. Rank Math's notice gives the start time in CEST, EDT and IST; the end-time conversions below are calculated from the UTC value.

Two things you will not find where you might look

If you check the PRO changelog to understand what 3.0.124 fixed, you will not see the incident mentioned. At the time of writing, the 3.0.124 entry repeats the same two bug fixes listed under 3.0.123 (a CSV import fix and an AI Link Genius export fix) and says nothing about security. Someone reading only the changelog would reasonably assume 3.0.124 is a routine maintenance release.

Also at the time of writing, Rank Math's security notice page carries a noindex directive. Depending on how search engines handle it, a site owner searching for the incident may land on third-party coverage before the vendor's own instructions. If you manage client sites, send the notice to your team directly rather than relying on them finding it. These details may change after publication, so check the pages yourself.

Is your site affected?

Your exposure depends on three facts: whether you received a copy during the window, whether that copy was installed, and whether it was activated. Rank Math's notice sets out the paths like this:

Rank Math also says it has records of which accounts downloaded an affected copy. If you received an email from Rank Math about this incident, follow its instructions even if your site has since moved to a different version. Verify that any such email is genuine by logging in at rankmath.com directly rather than clicking anything in it.

How to establish when 3.0.123 arrived

Rank Math's notice tells you to check your installed version in Plugins, which tells you what you have, not when it arrived. To narrow down the timing, gather what evidence you can:

• Your auto-update emails. WordPress sends an email after background plugin updates by default. Check the timestamp on any message mentioning Rank Math PRO around October 15 and 16.
• An activity log plugin, if you run one, will usually record plugin updates with a timestamp.
• Your backups. Compare the plugin version in a backup from October 15 with one from October 16 or 17.
• File timestamps on the server, shown below.

On a server with SSH and WP-CLI, run this from the WordPress root:

# Confirm the installed version and whether it is active
wp plugin list --fields=name,status,version | grep -i rank-math

# Show modification times for the plugin's main file and folder
ls -la --time-style=full-iso wp-content/plugins/rank-math-pro/ | head -n 5
stat wp-content/plugins/rank-math-pro/rank-math-pro.php

Treat file times as a clue, not proof. They reflect when files were written, which usually lines up with when an update ran, but anyone with write access can change them, and malware sometimes does exactly that. If the evidence is unclear, assume the worse case. Guessing wrong in the optimistic direction leaves a backdoor running.

Why updating to 3.0.124 does not clean the site

This is the point most likely to trip people up. A plugin update replaces the files inside the plugin's own folder. It does nothing to the rest of the site.

According to Rank Math and Wordfence, once an affected copy was activated, the malware could:

• set up persistent access and talk to an external server at rank1cdn[.]com,
• recreate a hidden backdoor whenever someone visited the site,
• create administrator accounts,
• drop PHP files in other plugins, themes, mu-plugins, and uploads,
• add a fake WordPress core file and rewrite .htaccess so .cache files execute as PHP,
• add a system-level cron entry for the web server user,
• read secrets the web server can reach, including database credentials, API keys and passwords.

None of those live in wp-content/plugins/rank-math-pro/. An update to 3.0.124 swaps the plugin folder and leaves every one of them where it is. Worse, because the malware can rebuild its backdoor on page load, deleting files in the wrong order can let it put them straight back.

That is why Rank Math's guidance has a strict sequence, and why "restore from a backup made before the window" is the recommended route for anyone who has one.

Indicators of compromise

These come from Rank Math's notice. Finding any of them means the site needs investigation. Finding none of them does not prove the site is clean, because an attacker with administrator access can make changes outside this list.

Checking quickly with WP-CLI and the shell

If you have SSH access, these read-only commands cover most of the list. Run them from the WordPress root. They do not change anything.

# 1. The three malicious options (works regardless of your table prefix)
for o in _uf6qdn2hmm t8krdk990phb _np5pvf754c; do
  wp option get "$o" >/dev/null 2>&1 && echo "FOUND option: $o"
done

# 2. Administrator accounts, with email and registration date
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

# 3. The fake core file, plus a full core checksum check
ls -la wp-includes/class-wp-cache-util.php 2>/dev/null
wp core verify-checksums

# 4. PHP files where they should not be
find wp-content/uploads -type f -name '*.php'
find wp-content/mu-plugins -type f -name '*.php' 2>/dev/null

# 5. Known string from the malware and suspicious function use
grep -rl --include='*.php' 'xmmqhn' wp-content wp-includes 2>/dev/null
grep -rl --include='*.php' 'proc_open' wp-content 2>/dev/null

# 6. .htaccess rules mentioning .cache, and .cache files containing PHP
find . -name '.htaccess' -exec grep -Hni '\.cache' {} \;
find . -type f -name '*.cache' -exec grep -l '<?php' {} + 2>/dev/null

# 7. WordPress scheduled events
wp cron event list

A few notes on reading the results. proc_open appears in some legitimate code, so a match means "look at this file", not "delete this file". The wp core verify-checksums command only covers WordPress core, and it will flag the fake class-wp-cache-util.php as a file that should not exist. Premium plugins like Rank Math PRO are not in the WordPress.org checksum database, so for those you compare against a fresh copy from the vendor.

The system crontab check needs to run as the web server user, which on many setups is www-data, nginx, apache, or a per-site user:

# Run as the web server user, or ask your host to check
crontab -l | grep -n 'ms6v46'

On shared or managed hosting you often cannot see the web server user's crontab, other users' crontabs, running processes, or authorized_keys files. Rank Math's notice tells you to review all of those. If you do not have access, that part of the investigation belongs to your host, and you should ask them to do it explicitly rather than assume it has been done.

Recovery path 1: restore from a clean backup

If you have a backup of both files and database taken before October 15, 2026 at 20:02 UTC, this is the route Rank Math recommends, and it is usually faster and more reliable than manual cleaning.

Important: A backup taken after 20:02 UTC on October 15 may already contain the malicious plugin or what it created. Check the backup's timestamp in UTC before trusting it.

1. Restore files and database together from the pre-window backup. Restoring only files leaves the malicious wp_options rows and any admin accounts in place. Restoring only the database leaves the files.
2. Run a security scan. Rank Math names Wordfence and Sucuri as examples.
3. Rotate every credential the site could read. This step is not optional, and the next section covers it in detail.
4. Install Rank Math PRO 3.0.124 by logging in at rankmath.com directly and downloading it from your account.

Anything that happened on the site between the backup and today is lost by the restore: orders, form entries, comments, new posts. On a WooCommerce store, export orders created since the backup before you restore, and plan how to re-enter them. Do not bring back plugin or theme files from the compromised copy to "save time", because that is how a backdoor survives a restore.

On MagicWP, daily off-site backups with one-click restore cover this case directly: pick a restore point from before the window opened. If you want to see what changed first, restore it into a staging copy and compare before touching production. The backups documentation explains the restore options.

Recovery path 2: clean the site manually

If no suitable backup exists, the site has to be cleaned by hand. Rank Math is explicit that the order matters: the malware can recreate its hidden backdoor whenever someone visits the site, so removing other files before disabling that mechanism may achieve nothing.

If you are not comfortable working in the database and on the server, this is a job for your host or a security professional. Take a full backup of the compromised state first anyway, so there is something to examine if the cleanup goes wrong.

Step 1: stop the malware from rebuilding itself

Do all three before anything else.

Delete the whole rank-math-pro folder. Deactivating the plugin is not enough. Delete the folder through SFTP, your host's file manager, or the shell:

rm -rf wp-content/plugins/rank-math-pro

Delete the three malicious options. In phpMyAdmin, open the wp_options table (your prefix may differ) and delete any row whose option_name matches one of the three values. With WP-CLI:

for o in _uf6qdn2hmm t8krdk990phb _np5pvf754c; do
  wp option delete "$o"
done

On MagicWP you can open a temporary phpMyAdmin session from the site's database tools if you prefer to see the rows before deleting them.

Block outbound traffic to rank1cdn[.]com. Rank Math says to do this if your host or firewall supports it. On managed hosting, open a ticket and ask for the block by name. On a server you run yourself, use your outbound firewall or egress proxy. Then check whether the site was already talking to it:

# Paths vary by server; adjust to where your logs live
grep -ri 'rank1cdn' /var/log/ 2>/dev/null | head

Web server access logs record incoming requests, so outgoing connections from PHP often will not show up there. A clean result from this grep does not mean the site never connected out.

Step 2: find and remove what was left behind

Work through every indicator in the table above. For each one:

• Unknown administrators. Remove accounts starting with wpsupport_ or using @wp-mail[.]net addresses, but look at every admin account, not just those patterns. When deleting a user with WP-CLI, decide where their content goes with --reassign.

  terminal

  wp user delete <user-id> --reassign=<your-admin-id>

• The fake core file. Delete wp-includes/class-wp-cache-util.php, then reinstall core from WordPress.org without touching wp-content:

  terminal

  rm -f wp-includes/class-wp-cache-util.php
  wp core download --skip-content --force --version=$(wp core version)
  wp core verify-checksums

• Hidden PHP files. Investigate each match from the earlier checks. PHP in uploads/ is almost never legitimate. For plugin and theme folders, the safest approach is to delete the folder and reinstall a fresh copy from the official source rather than trying to spot every injected line.

• .htaccess changes. Remove any rule that maps .cache (or any non-PHP extension) to the PHP handler, in the root file and every subdirectory. Then delete .cache files that contain PHP.

• Scheduled tasks. Remove system cron entries tagged #ms6v46 and any WordPress cron events you cannot explain. wp cron event delete <hook> removes a WordPress event.

• The server environment. Check authorized_keys files, crontabs for other users, running processes, and any writable location outside the site directory. On shared hosting, ask your host.

Step 3: check that nothing comes back

After cleaning, reload a few front-end pages, wait, and check again. If the fake core file, the options, or any deleted file reappears, something in Step 1 or Step 2 was missed. Go back to the list rather than deleting the same file a second time.

Rotate every credential the site could reach

This applies to both recovery paths. A restore removes the malware, but it cannot take back anything that was already read off the server while the bad copy was running. Rank Math's notice tells affected site owners to assume every secret the site could access has been exposed.

Several of these can be done from WP-CLI:

# Regenerate keys and salts (logs out every user)
wp config shuffle-salts

# Review Application Passwords for a given user
wp user application-password list <user-id>

The order is worth thinking about. Change the database password and the salts after the cleanup is finished, not before. If the backdoor is still active while you rotate, the new values may be read just as easily as the old ones.

On WooCommerce stores, payment gateway keys deserve particular care. Many gateways let you roll keys without downtime by creating a new key, updating the site, and then revoking the old one. Check your gateway's documentation for the right sequence before revoking anything.

Verify the cleanup and install 3.0.124

Rank Math's verification steps are short:

1. Run a full security scan.
2. Run wp core verify-checksums for WordPress core.
3. Run wp plugin verify-checksums --all for plugins from WordPress.org. Premium plugins will report that no checksums are available, which is expected. Compare those against a fresh copy from the vendor instead.
4. Monitor outgoing connections and site behaviour over the following days.
5. Check that files you removed stay removed.

Then install 3.0.124. Go to rankmath.com in your browser, log in, and download it from your account. Rank Math says some users may need to reset their account password to log in. It also says it will never send login or download links by email, so treat any message offering a "clean version" or a "password reset" link with suspicion. Incidents like this one are a common hook for phishing.

What this incident does and does not tell you

This was a vendor distribution compromise, which puts it in a different category from the usual plugin vulnerability. With a normal CVE, the attacker needs to find your site and send it a crafted request, and a firewall rule can stop that request. Here, there was nothing to stop at the edge: the harmful code arrived through an update you were meant to trust, and it ran with the same permissions as every other plugin on the site.

A few practical lessons follow, and none of them require any new tools:

• Auto-updates cut both ways. They close known vulnerabilities fast, which is usually the right trade. They also deliver a tampered package fast. Sites that update immediately on every release were the ones most likely to land in an eleven-hour window. For business-critical sites, some teams hold non-security updates for a day or two, or let them reach staging first. That is a judgment call, not a rule, and holding back security fixes carries its own risk.
• Backups need to be old enough and complete enough. This incident is a clean example of why retention matters. A backup set that only keeps the last day or two may contain nothing from before the window by the time you find out. The backup also needs both files and database.
• The blast radius is everything PHP can read. The credential list above is long because the malware ran inside WordPress. Keeping secrets out of the database where possible, scoping API keys to the minimum permissions they need, and knowing where each one lives makes rotation after an incident much faster.
• Your host's visibility matters. Outbound blocking, system crontabs, process lists and other users' files are all outside what a WordPress admin can see. If you are on a host where you cannot get those checked, find out before you need it.

What the incident does not tell you is how the packages were altered, how many sites received a bad copy, or whether any data taken from affected sites has been used. Rank Math describes the number of affected users as limited and has not published a figure. Treat any number you see quoted elsewhere with caution unless it comes from Rank Math.

Frequently Asked Questions

Is the free Rank Math SEO plugin affected?

Rank Math's security notice covers Rank Math PRO 3.0.123 only and does not mention the free plugin. The Wordfence and Patchstack entries for CVE-2026-111862 also list only Rank Math SEO PRO. The free plugin is distributed through WordPress.org, while PRO is downloaded from Rank Math's own servers, and the compromise was in PRO packages. If you run both, which is the normal PRO setup, the steps in this guide apply because of the PRO add-on.

I updated to 3.0.124. Am I safe now?

Only if an affected copy of 3.0.123 was never activated on your site. If it was, updating replaces the plugin files but does not remove administrator accounts, backdoor files, .htaccess changes, or cron entries the malware may have created elsewhere. Rank Math's guidance for those sites is a full recovery and credential rotation, not just an update. Use the timing checks above to work out which group you are in.

My site shows version 3.0.123. Does that mean it was hacked?

No. Version 3.0.123 was released on October 7, 2026, and Rank Math limits the incident to copies downloaded or updated between 20:02 UTC on October 15 and 07:12 UTC on October 16. A site that updated before the window opened received a clean copy, according to Rank Math. The version number alone is not evidence either way. What matters is when the copy arrived and whether it was activated.

Is deactivating the plugin enough?

No. Rank Math says to delete the entire rank-math-pro folder, because deactivation is not sufficient. Then delete the three malicious wp_options rows and block outbound traffic to rank1cdn[.]com before cleaning anything else. The malware can rebuild its backdoor on page load, so doing the steps out of order can undo your work.

Can I restore a backup from October 16?

Only a backup made before 20:02 UTC on October 15, 2026 can be considered clean. A backup from later may already contain the malicious plugin or the changes it made. Check the backup's timestamp in UTC rather than your local time, restore both files and database, and rotate credentials afterward, because the restore cannot undo any secrets that were already read.

My security scan found nothing. Is the site clean?

A clean scan is a good sign but not proof. Rank Math's notice says the absence of the listed indicators does not, by itself, show a site is clean, because an attacker with administrator access could have made other changes. If an affected copy was activated, do the credential rotation regardless of the scan result, and keep checking for outbound connections and files that reappear.

Is this related to the Rank Math Support Agent controversy?

No, they are different incidents. In late August 2026, the free Rank Math plugin added an AI Support Agent that created WordPress Application Passwords, and Rank Math paused that feature in version 1.0.277.2. That was a shipped feature that drew criticism. The 3.0.123 incident is a tampered PRO package containing malware. Rank Math has not connected the two, and nothing published so far links them.

Why is there no firewall rule for this?

A web application firewall blocks malicious requests coming in from outside. This malware arrived inside a plugin update and ran from within WordPress, so there is no incoming attack request to block. Patchstack noted exactly this when it said a mitigation rule was not possible. Detection here relies on scanning files and the database, watching outbound traffic, and checking for the specific indicators Rank Math published.

Conclusion

The Rank Math SEO PRO 3.0.123 malware incident comes down to one question: did a copy downloaded between 20:02 UTC on October 15 and 07:12 UTC on October 16 get activated on your site? If not, update to 3.0.124 from your Rank Math account and move on. If it did, or you cannot rule it out, the version number is the least of your concerns. Restore files and database from a backup made before the window if you have one. If you do not, clean in Rank Math's order: plugin folder, the three options, the outbound block, then everything else. Either way, rotate every credential the site could read.

The final warning is the one most often skipped: 3.0.124 is not a cleanup tool. It replaces one folder.

If you run your sites on MagicWP, daily off-site backups with one-click restore, staging, SSH and WP-CLI access, and managed malware scanning cover most of the steps above. The security documentation and backups documentation explain how they work. For the server-level checks WordPress cannot see, ask support to review them for your site rather than assuming they have been done.