Rank Math PRO plugin downloads carried malware that could backdoor WordPress sites

Rank Math says a limited number of users who downloaded Rank Math PRO v3.0.123 between October 15, 2026, at 20:02 UTC and October 16, 2026, at 07:12 UTC received plugin files containing malware.

The malware could compromise a site once the plugin was activated.
"The affected plugin files contained malware that could compromise your website if the plugin was activated," Rank Math said. "We immediately removed the affected files and released a clean version, Rank Math PRO v3.0.124." Only the PRO version was affected. The free Rank Math SEO plugin on WordPress.org was not.

The malware plants backdoors and exposes site secrets.
According to Rank Math's advisory, as reported by BleepingComputer, the malware establishes persistent access, communicates with rank1cdn[.]com, and recreates hidden backdoors when someone visits an infected site. Rank Math warns that database credentials, API keys and other secrets accessible to the web server may be exposed.

Sites that activated 3.0.123 should be treated as compromised.
Rank Math recommends restoring files and the database from a backup made before October 15 at 20:02 UTC, running a security scan, and rotating all passwords, database credentials, API keys, WordPress keys and salts, and hosting and SSH access. Rank Math says deactivating the plugin alone is not sufficient. Without a clean backup, manual cleanup means deleting the plugin folder and malicious database entries, then checking for further backdoors, unknown administrator accounts, altered files and scheduled tasks. Rank Math also advises blocking outbound connections to rank1cdn[.]com.

Indicators include wpsupport_ admin accounts.

BleepingComputer listed indicators from the advisory, including administrator accounts with the wpsupport_ username prefix, a wp-includes/class-wp-cache-util.php backdoor, the _np5pvf754c database entry and the #ms6v46 cron marker. Users who installed but never activated 3.0.123 should delete it, install clean 3.0.124 from their Rank Math account, and run a scan.