Rank Math Hacked in Supply Chain Attack, Shipped a Self-Rebuilding Backdoor

Rank Math has confirmed that some copies of Rank Math PRO 3.0.123, the paid add-on to one of WordPress’s most widely used SEO plugins, carried malware for just over 11 hours on 15 and 16 October 2026.

Sites that downloaded or updated to the build between 20:02 UTC on 15 October and 07:12 UTC on 16 October (01:32 to 12:42 IST on 16 October) and then activated it should be treated as fully compromised, the company said in a security notice. Upgrading to the clean 3.0.124 release does not undo the damage.

“We immediately removed the affected files and released a clean version,” Rank Math wrote. The company says only a limited number of customers received a tainted copy and that it is emailing the users its download records flag. It has not said how many sites were affected or how attackers got malicious code into its official distribution channel. The notice covers only the PRO add-on and does not list the free Rank Math plugin distributed through WordPress.org.

WordPress security firm Wordfence tracks the incident as CVE-2026-111862 with a critical CVSS score of 9.8, classifying it as unauthenticated embedded malicious code. Wordfence also notes that running version 3.0.123 does not by itself mean a site was hit. Only copies pulled during the 11-hour window were tampered with, so a site that installed 3.0.123 earlier received a clean build.

Once activated, the malicious build contacts a lookalike domain, rank1cdn[.]com, and plants a hidden backdoor that rebuilds itself every time someone loads a page on the site. According to Rank Math, the malware can also create administrator accounts with usernames starting wpsupport_ or email addresses ending in @wp-mail[.]net. It can drop a fake core file at wp-includes/class-wp-cache-util.php, edit .htaccess so that .cache files execute as PHP, and add system cron jobs tagged #ms6v46. It can also reach beyond WordPress into SSH authorized_keys files and other users’ crontabs. Rank Math tells owners to assume that every password, database login and API key the site could read has been exposed.

How to check and clean a Rank Math PRO site

Rank Math splits affected sites into three groups:

Downloaded but never installed. The incident alone gives no sign of compromise.

Installed but never activated. Owners should delete the plugin files, install 3.0.124 and run a malware scan.

Activated during the window. The site counts as compromised. Rank Math recommends restoring both files and the database from a backup taken before 20:02 UTC on 15 October, then scanning with a tool such as Wordfence or Sucuri.

Where no clean backup exists, order matters, because the backdoor rebuilds itself if its trigger is left in place. Owners must first delete the entire rank-math-pro folder, since deactivating the plugin is not enough. Next, they should remove any of three wp_options database rows named _uf6qdn2hmm, t8krdk990phb or _np5pvf754c, and block outbound traffic to rank1cdn[.]com if their host allows it.

Only after those three steps should owners hunt for leftovers. Rank Math’s indicators include PHP files in wp-content/mu-plugins/ or theme inc/, includes/ and lib/ folders that combine base64_decode with XOR loops, the string xmmqhn, proc_open calls or PHP-FPM socket code. Any PHP file inside uploads/ is also suspect. Running wp core verify-checksums and wp cron event list surfaces altered core files and planted scheduled tasks.

Credential rotation is required even after a clean restore. That covers the database password in wp-config.php, WordPress security keys and salts, payment-gateway and SMTP keys, hosting panel, FTP and SSH logins, and administrators’ two-factor settings. Rank Math says the clean 3.0.124 build should be downloaded only by logging in directly at rankmath.com. The company says it never emails login or download links, and some customers may need to reset their account password first.

Second WordPress vendor compromise in four days

Days after the Rank Math window closed, a separate incident hit another major WordPress plugin maker. TeamUpdraft, the developer of the UpdraftPlus backup plugin, said on 19 October that an intruder accessed its customer database over the weekend of 17–18 October and took connection keys for its UpdraftCentral remote management service. Attackers are already using those genuine, signed keys to push backdoor plugins onto connected WordPress sites, and no UpdraftPlus update stops the commands.

Rank Math’s malware was embedded in the plugin package itself, while TeamUpdraft says the UpdraftPlus plugin and its downloads were untouched.

In both cases, though, the attack came through a channel the site is built to trust, so a malware-free plugin release does not clean the site. Neither company has said how its systems were breached, and there is no indication the two incidents are connected.

Both follow the April compromise of Smart Slider 3 Pro, when an attacker broke into developer Nextend’s update infrastructure and pushed a backdoored version 3.5.1.35 that stayed live for about six hours. Patchstack called that incident “a textbook supply chain compromise.” The same week, WordPress.org permanently closed more than 30 plugins from the EssentialPlugin portfolio after a buyer planted a dormant backdoor in them. Premium plugins such as Rank Math PRO and UpdraftPlus Premium are delivered and managed through their vendors’ own servers, outside WordPress.org’s plugin review.