Rank Math PRO malware: what to check on your WordPress site

Rank Math is a widely used SEO plugin for WordPress. For about eleven hours in October, some copies of its paid version came with malware. Rank Math says a limited number of users were affected. Here is how to find out if you are one of them.

Short answer. Only some copies of Rank Math PRO 3.0.123, downloaded or updated between 20:02 UTC on 15 October and 07:12 UTC on 16 October 2026, carried malware. The free Rank Math plugin is not affected. If a copy from that window was active on your site, treat the site as compromised: updating to 3.0.124 is not enough, so restore from a clean backup or get it cleaned, then change your passwords.

Who is and is not affected#

You are not affected if:

• You use the free Rank Math SEO plugin from WordPress.org. Rank Math says it is not affected and needs no action.
• You use a different SEO plugin, or no WordPress at all.
• Your copy of Rank Math PRO was not downloaded or updated in the window above.

You may be affected if you run Rank Math PRO and a copy of version 3.0.123 reached your site between 20:02 UTC on 15 October and 07:12 UTC on 16 October 2026. In UK time (BST, which was in force then) that is 21:02 on 15 October to 08:12 on 16 October.

Rank Math's changelog dates 3.0.123 to 7 October. Wordfence, the WordPress security firm, says version 3.0.123 alone does not prove a compromise. Only copies from the window are affected, and 3.0.123 had been out since 7 October. The date matters more.

1. 15 Oct20:02 UTC: the window opens. Some 3.0.123 downloads and updates from this point contain malware.
2. 16 Oct07:12 UTC: the window closes.
3. 16 OctRank Math releases the clean 3.0.124 and publishes its security notice. Wordfence publishes its own warning the same day.

A two-minute check: are you affected?#

Stop as soon as you get a "no".

1. Free or PRO? Log in to WordPress and go to Plugins > Installed Plugins. Look for Rank Math PRO (it may show as Rank Math SEO PRO). If you only see Rank Math SEO and no PRO, you are not affected.
2. Which version? The version number sits under the plugin name. If it is below 3.0.123, you are not affected. If it is 3.0.124 or higher, the clean version is installed now, but you still need step 3, because you may have had a bad copy first.
3. When did it arrive? You need to know if version 3.0.123 reached your site inside the window. These can tell you:
   • Update emails. WordPress sends an email to the site owner after plugins auto-update, by default. Search your inbox for it around 15 and 16 October.
   • Your host's backup list. Backups are timestamped. If a backup taken after the window shows 3.0.123, and one from before it does not, the update landed in between.
   • The plugin folder's date. In your host's file manager, open wp-content/plugins/ and look at the modified date on the rank-math-pro folder. Treat this as a clue, not proof, because other changes can alter the date.
   • An activity log. If you run a plugin that logs changes, it will show when Rank Math PRO was updated or activated.
4. Was auto-update on? Under Plugins > Installed Plugins, the Automatic updates column shows "Enable auto-updates" or "Disable auto-updates" for each plugin. If it updates itself, a bad copy could have arrived without anyone clicking anything.
5. Did Rank Math email you? Rank Math's changelog says all impacted customers were notified. Wordfence adds that if Rank Math notified you, you should follow the recovery steps even if your site now runs a different version. Do not click links in any email about it, though. Rank Math says it will never send login or download links by email, so go to rankmath.com directly.

If you still cannot tell, ask your host. They can often see the update in server logs.

The three cases#

Swipe the table sideways on a phone.

If the bad copy was active: the recovery steps#

Option 1: restore from a clean backup. This is Rank Math's recommended route. Ask your host to restore the files and the database from a backup made before 20:02 UTC on 15 October (21:02 UK time). Scan, change every credential, then install 3.0.124.

One thing the notice does not spell out: a restore rolls the site back to that date. Anything added since, such as orders, form entries or new posts, will be gone from the restored copy. Ask your host to export those first. That point is my own reading, not Rank Math's.

Option 2: clean it by hand. If there is no suitable backup, the site must be cleaned. Rank Math warns that the malware can rebuild its hidden backdoor whenever someone visits the site, so the order matters. It names three first steps:

1. Delete the whole rank-math-pro folder using your host's file manager or FTP. Deactivating the plugin is not enough.
2. In the wp_options database table, delete any entry named _uf6qdn2hmm, t8krdk990phb or _np5pvf754c.
3. Block outgoing connections to rank1cdn.com, if your host or firewall can do it.

Only then should anyone hunt for the other changes. These are Rank Math's own indicators.

• Unknown administrator users, with names starting wpsupport_ or emails ending @wp-mail.net.
• A file called wp-includes/class-wp-cache-util.php, which is not a real WordPress file.
• Rules in .htaccess that let .cache files run as PHP.
• Cron jobs, including a system entry tagged #ms6v46.
• Hidden PHP files in wp-content/mu-plugins/, other plugins' folders, the inc/, includes/ and lib/ folders of any non-default theme, and the Rank Math includes folder.
• PHP files inside the uploads folder, where they generally should not be.

If you are not comfortable with files, databases or server settings, Rank Math says to ask your host or a security professional. I agree.

Why updating to 3.0.124 is not enough#

Updating swaps the plugin for the clean one. It does not go looking for anything the bad copy did while it was running.

Wordfence says the malware may have placed extra files, administrator accounts or scheduled tasks elsewhere on the server. A clean plugin on top of a planted backdoor is still a site someone else can get into.

The passwords and keys to change#

Rank Math says to change these even if you restored from a backup. Assume anything the site could read has been seen.

• All WordPress user passwords, starting with administrators.
• The database username and password in wp-config.php.
• The WordPress security keys and salts in wp-config.php.
• API keys and service logins stored on the site: payment gateways, email sending (SMTP) and anything similar.
• Your hosting control panel, FTP, SFTP and SSH logins.
• Two-factor authentication for administrators: check it and reset it where needed.

Copy and send this to your developer or host#

If you would rather hand this over, paste the list below into an email. Add your site address.

1. Check whether Rank Math SEO PRO 3.0.123 was installed or updated on [your site] between 20:02 UTC on 15 October 2026 and 07:12 UTC on 16 October 2026, and whether it was activated. Please tell me what you find.
2. If it was activated, restore the files and database from a backup made before 20:02 UTC on 15 October 2026, or clean the site following Rank Math's security notice. Export any orders or form entries made since that backup first.
3. Check for administrator users starting wpsupport_ or with @wp-mail.net emails. Check for wp-includes/class-wp-cache-util.php, .cache execution rules in .htaccess, and cron entries tagged #ms6v46.
4. Look for _uf6qdn2hmm, t8krdk990phb and _np5pvf754c in wp_options, and block outgoing connections to rank1cdn.com.
5. Run wp core verify-checksums and wp plugin verify-checksums --all, run a Wordfence or Sucuri scan, check the uploads folder for PHP files, and check the theme's inc/, includes/ and lib/ folders.
6. Change my database password, security keys and salts, hosting, FTP, SFTP and SSH logins, and any API keys the site holds. Reset admin two-factor authentication.
7. Reinstall Rank Math SEO PRO 3.0.124 from my account at rankmath.com, then confirm in writing what was found and what was changed.

Your SEO settings and free Rank Math accounts#

This part is a separate problem and only touches the free plugin. Rank Math says it refreshed some systems during its response, and free accounts registered between 13 and 16 October 2026 were removed. If yours was one, Rank Math has emailed you.

The plugin keeps working, and Rank Math says your SEO settings, metadata and content are unaffected. What stops until you recreate the account and reconnect the site is the Rank Math login, the Search Console and Analytics data shown inside Rank Math, the keyword rank tracker and the Rank Math AI features.

To fix it, register again at rankmath.com with the same email or social login, then in WordPress go to Rank Math SEO > Dashboard > Help, disconnect the account if it still shows as connected, and click Connect Now. If you use Content AI, then go to Rank Math SEO > Content AI > Usage and click Refresh.

For PRO sites that need a clean-up, I could not find a statement about settings in the notice, and I have not tested it. Ask your developer to save a copy of your current setup before anything is deleted.

When to get help#

Do the two-minute check yourself. If it comes back "not affected", you are done.

If it says you may be, or you cannot tell, ask your host first. Most hosts can restore a backup and check logs. A developer should do anything involving the database or server settings.

If your site was hit and you want someone to check the SEO side afterwards, I can help with a technical SEO check. Get in touch and tell me what happened.

This was not the only security problem in October. If your host also runs an old version of PHP, read my post on the PHP2Shell vulnerability and how to patch PHP.

Sources#

Every page below I opened on 4 November 2026. I read each one two ways (a direct fetch and a separate scrape), except where noted.

• Rank Math, "Rank Math PRO 3.0.123 Security Incident: How to Secure Your Website", incident notice published 16 October 2026 (primary): Rank Math incident page
• Rank Math, PRO changelog, entries for 3.0.123 (7 October 2026) and 3.0.124 (16 October 2026) (primary): Rank Math PRO changelog
• Wordfence, "PSA: Malware Found in Some Rank Math SEO PRO 3.0.123 Downloads", 16 October 2026 (secondary, and I could read this one only through the scrape, not the direct fetch): Wordfence PSA
• NIST National Vulnerability Database, CVE-2026-111862, published 19 October 2026 (secondary): NVD record
• SecurityWeek, "Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack", 19 October 2026 (secondary): SecurityWeek article
• BleepingComputer, "WordPress SEO plugin Rank Math compromised to backdoor websites", 19 October 2026 (secondary): BleepingComputer article
• WordPress.org documentation, "Plugin and themes auto-updates" (undated page, secondary for my auto-update and email notes): WordPress.org auto-updates page

I have not seen a published count of how many sites were affected. Rank Math describes a "limited number" of users. The UK time conversion and the point about restores rolling back recent data are my own, not from a source.