Rank Math PRO CVE-2026-111862: Backdoored Official Update

If you run Rank Math PRO and installed or updated it between October 15 and 16, 2026, treat your site as compromised. Attackers broke into Rank Math’s own systems and slipped a backdoor into the official PRO 3.0.123 package. For about eleven hours, anyone who downloaded or auto-updated PRO got the infected copy straight from the vendor. Activating it was enough to hand over the site. The free plugin on WordPress.org was not affected.

At a glance

CVE	CVE-2026-111862
Plugin	Rank Math SEO PRO, the paid add-on to Rank Math SEO (the free plugin runs on 4 million+ sites; the number of PRO sites hit hasn’t been disclosed)
Type	Supply-chain compromise: a self-restoring backdoor embedded in the official package
Severity	CVSS 9.8 (critical), no login needed
Affected	PRO 3.0.123, downloaded or updated between October 15, 2026, 20:02 UTC and October 16, 2026, 07:12 UTC. Copies of 3.0.123 obtained earlier are clean
Fixed	3.0.124, but installing it does not remove anything the malware already planted
Status	Every site that activated an infected copy should be treated as compromised

What’s wrong

There’s no bug to patch here. Rank Math’s code was fine. The problem is the channel it travels through. A WordPress site trusts whatever its plugin vendor’s update server hands it, and runs it with full access to the files, the database and every secret in wp-config.php. Whoever controls that server controls every site that updates from it.

Rank Math hasn’t said how the attackers got in. What’s known so far:

Setup. The command-and-control domain, rank1cdn[.]com, was registered on October 14 at 19:31 UTC, a day before the attack. Rank Math also deleted free rankmath.com accounts registered between October 13 and 16, which suggests the attacker was preparing on its systems for days. Rank Math hasn’t connected the two publicly.
The swap. At 20:02 UTC on October 15, the PRO 3.0.123 package on Rank Math’s servers started carrying the backdoor. The real 3.0.123 had already shipped, so to a site owner it looked like nothing had changed.
Delivery. Sites that downloaded PRO from rankmath.com or pulled it as an update during the window got the infected copy.
Activation. Once the plugin ran, the malware phoned home to rank1cdn[.]com, spread backdoors into other folders and set up ways to reinstall itself, including on ordinary page visits.
Cleanup. At 07:12 UTC on October 16, Rank Math pulled the files and released a clean 3.0.124.

Eleven hours was enough. By then the malware didn’t need the plugin anymore.

What the attacks look like

There’s no exploit traffic to show, because there was no exploit. The sites installed the backdoor themselves. What you look for instead is what it leaves behind. Rank Math’s notice lists:

Network: outgoing connections to rank1cdn[.]com. No IP addresses have been published.
A fake core file: wp-includes/class-wp-cache-util.php. It isn’t part of WordPress.
Hidden PHP files in wp-content/mu-plugins/, inside other plugins’ folders, in the inc/, includes/ and lib/ folders of non-default themes, in Rank Math’s own includes/ folder, and in uploads/.
.cache files that contain PHP, plus .htaccess rules telling the server to run them.
Code patterns: base64_decode combined with an XOR loop using the key xmmqhn, proc_open, and code that talks to the PHP-FPM socket directly.
Database: wp_options rows named _uf6qdn2hmm, t8krdk990phb and _np5pvf754c.
Accounts: administrators with usernames starting wpsupport_ or emails ending @wp-mail[.]net.
Persistence: crontab entries tagged #ms6v46, unexpected WordPress scheduled events, other users’ crontabs, and unknown keys in SSH authorized_keys.

The indicators that are easiest to search for, in one place:

rank1cdn[.]com
wp-includes/class-wp-cache-util.php
_uf6qdn2hmm
t8krdk990phb
_np5pvf754c
wpsupport_
@wp-mail[.]net
#ms6v46
xmmqhn

Blocking the domain is worth doing, but it won’t clean anything. The backdoors are already on the server and work without it.

BleepingComputer also found a PHP sample with the same indicators that steals AWS, Cloudflare, Google Cloud and Azure credentials and SSH keys. It couldn’t confirm the sample was spread through Rank Math, and neither Rank Math nor Wordfence mentions it. Assume the worst anyway: anything the web server could read, the attacker could read.

What to do

1. Work out whether you’re affected

Free Rank Math only: not affected.
PRO, but last downloaded or updated outside the window: not affected by this incident. Running 3.0.123 on its own doesn’t prove anything.
PRO 3.0.123 downloaded during the window but never installed: delete the file and download 3.0.124.
Installed during the window but never activated: delete the plugin folder, install 3.0.124 and scan the site.
Activated during the window: treat the site as compromised and work through the steps below.

Check your update logs, your backup history or the folder’s modification time to see when 3.0.123 arrived.

2. Clean up, in order

The easiest way out is to restore files and the database from a backup taken before October 15, 2026, 20:02 UTC, then skip to rotating secrets. Without a clean backup, the order matters, because the malware rebuilds itself:

Stop it rebuilding. Delete the entire rank-math-pro plugin folder (deactivating isn’t enough), delete the three wp_options rows listed above, and block outgoing connections to rank1cdn[.]com if your host allows it.
Remove what it planted. Go through the indicator list: hidden PHP files and .cache files, the .htaccess rules, the fake class-wp-cache-util.php, rogue admins, cron entries and SSH keys. Reinstall WordPress core, plugins and themes from clean official copies.
Rotate every secret. WordPress passwords, the database password and the salts in wp-config.php, API, payment and SMTP keys, hosting panel and SFTP/SSH logins, and anything else stored on the server. Do this even if you restored from a backup. The secrets were exposed either way.
Verify. Run wp core verify-checksums, scan with Wordfence or Sucuri, and keep watching for a few days. If deleted files come back, something was missed. Go back to step 2.

Only then install 3.0.124, logging in at rankmath.com directly. Rank Math says it never sends login or download links by email, so treat any email offering one as a scam.

3. Don’t let production update itself

The infected package was live for eleven hours. A site that waited a day before updating never touched it. Automatic plugin updates on a production site mean the first copy of any release, good or bad, runs on the site that matters most, with nobody watching. Turn them off in a must-use plugin, and push updates through staging first. A few days there catches broken releases, and some of the poisoned ones:

<?php
// wp-content/mu-plugins/no-auto-updates.php
add_filter( 'auto_update_plugin', '__return_false' );

Then update deliberately: on staging first, then production, after the release has been out long enough for someone else to notice a problem. We covered how to set that up in Why Dev, Staging and Prod?. Hold off on critical security fixes for too long and you get a different problem, so read the changelog and decide case by case.

The bigger lesson

We usually talk about plugin risk in terms of bugs: a missing permission check, an unvalidated upload. This one is different. The code was fine, and the trust was the problem. Every plugin you install comes with a vendor’s build and release pipeline that you can’t inspect, and an update server that can push new code to your site whenever it likes. A popular commercial plugin is an attractive target precisely because one break-in reaches thousands of sites at once.

That’s another reason every plugin has to earn its place. This site runs a short plugin list on purpose, as we described in Classic Enterprise. Each plugin you drop is one less vendor whose servers you’re trusting with your site.

Rank Math PRO CVE-2026-111862: Official Update Shipped a Backdoor