A Paid SEO Plugin Shipped a Self-Healing Backdoor for 11 Hours: The Rank Math PRO Response Clock for WordPress Site Owners
For roughly 11 hours last week, the official download and update channel for Rank Math PRO handed out copies carrying malware. If one of your WordPress sites picked up that build and turned it on, updating is not enough. Here is how to tell whether you are in scope and what to do, hour by hour.
Most WordPress owners are taught that the safe move is to keep plugins updated. This incident turns that advice on its head for a short stretch of time: the paid edition of a widely used search-optimization plugin was delivering malware through its own vendor’s website and update system. Sites that installed and switched on one of those copies should be handled as hacked, even if they have since moved to the clean release.
The details here come from a detailed breakdown by The Hacker News of the vendor’s security notice and Wordfence’s advisory, with additional findings from BleepingComputer’s coverage.
Minute zero: are you even in scope?
Only the PRO plugin, which customers download from rankmath.com, is involved. The free Rank Math SEO plugin listed on WordPress.org (more than 4 million active installations) is not named in the vendor’s notice. The tainted window ran from 20:02 UTC on October 15 to 07:12 UTC on October 16, which is 4:02 PM Eastern on Thursday to 3:12 AM Eastern on Friday.
- Installed and activated a PRO copy fetched in that window: treat the site as compromised, even if it now shows the clean version 3.0.124.
- Installed but never activated it: remove the plugin files, install 3.0.124 from your Rank Math account and scan the site.
- Downloaded it but never installed it: nothing in this incident alone points to a compromise.
- Not sure? Rank Math asks customers in that position to contact its support team.
One trap: the version number will not settle the question. The affected build carried the label 3.0.123, the same number as a release dated October 7, so a copy obtained before the window opened is fine while one fetched during it is not.
The first hour: stop the bleeding
The malware is built to put its hidden backdoor back whenever someone visits the site, so deleting a suspicious file here and there can be undone by the next page view. The vendor’s guidance is that simply deactivating the plugin does not help either. The order matters:
- If you have a backup of the site files and database from before 20:02 UTC on October 15, restoring it is the vendor’s preferred route. Scan the restored site and change every credential before you install the clean plugin.
- Without a clean backup, delete the whole rank-math-pro folder using your host’s file manager or FTP.
- In the wp_options database table, remove any entries named _uf6qdn2hmm, t8krdk990phb or _np5pvf754c.
- Ask your host or firewall to block outgoing traffic to rank1cdn[.]com, the domain the malware talks to.
The first day: hunt for what it left behind
Installing 3.0.124 swaps the plugin itself but does not clean up anything the malware already planted elsewhere, Wordfence warned. Places to look include:
- PHP files that do not belong in wp-content/mu-plugins/, inside other plugins’ folders, in the code folders of non-default themes, and in uploads/.
- A file called wp-includes/class-wp-cache-util.php, which is not part of WordPress core.
- Administrator accounts with usernames starting wpsupport_ or email addresses ending in @wp-mail[.]net.
- Changes to .htaccess that let .cache files run as PHP, and cron entries tagged #ms6v46, plus any new scheduled WordPress events or SSH keys.
Wordfence adds an important caveat: not finding these markers does not prove a site is clean. BleepingComputer separately found a PHP sample on VirusTotal carrying the same markers that can run commands, edit the WordPress database and pull out cloud credentials for services such as AWS, Azure, Google Cloud and Cloudflare, along with SSH keys. It could not confirm that sample was spread through the plugin.
The first week: rotate everything the site could touch
Assume every secret the web server could read has been exposed, whether you restored or cleaned by hand. That list runs from WordPress passwords and the database login in wp-config.php to the security keys and salts in the same file, payment, email (SMTP) and other API keys, hosting panel, FTP, SFTP and SSH access, and any secrets in environment variables. Turn on two-factor sign-in for administrators while you are at it. Finish with a security scan and checksum checks of WordPress core and plugins, keeping in mind that WordPress.org publishes no checksums for this premium plugin, so a fresh copy from the vendor is the comparison point.
When you reinstall, sign in at rankmath.com directly. The vendor says it will never email login or download links, which makes any such message a likely phishing attempt.
Still unanswered
- How the malicious files got into the vendor’s download and update system.
- How many customers received a tainted copy, and whether automatic updates delivered it.
- Who is behind it. Wordfence has assigned the incident CVE-2026-111862 with a 9.8 severity score, and Patchstack says no firewall rule can mitigate it because the vendor’s own systems were the entry point.
The Hacker News counts this as at least the third time this year that a premium WordPress plugin’s own update channel has handed out backdoored builds.
What this means for your company
Even if you have never heard of this plugin, the lesson applies to any business website: an update from a trusted vendor can be the attack. Know which premium plugins your sites run and who installs their updates, keep dated off-server backups of both files and database so you can roll back to a known-good point, and keep the secrets stored on a web server to the minimum it truly needs. If your site is built or hosted by an outside agency, ask them this week whether Rank Math PRO is installed anywhere and what they did during the October 15–16 window.
Need help checking your WordPress sites, cleaning up after a plugin compromise or setting up reliable website backups? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
