- Rank Math says some copies of Rank Math SEO PRO 3.0.123, obtained October 15-16, 2026, contained malware. It released 3.0.124 as the clean replacement.
- Installing 3.0.124 does not remove backdoors, rogue administrator accounts or scheduled tasks the malware may have created. Sites where an affected copy was active should be treated as compromised.
- Ask your team which version and date each site obtained, whether a clean backup predates the window, and who can replace exposed credentials.
We usually treat a software update as the fix. In this incident, the update was the problem, and the replacement update does not finish the job. The lesson for anyone who runs a website is that a patch replaces a file. Only a recovery restores trust in the server.
What Rank Math disclosed
Rank Math has warned that some copies of its Rank Math SEO PRO plugin, version 3.0.123, carried malicious code. Wordfence, a WordPress security firm, published a summary of the notice on October 17, 2026.
A site may be affected if it fetched the plugin, or received it as an update, from 20:02 UTC on October 15, 2026 until 07:12 UTC on October 16, 2026. Rank Math pulled the tainted files and issued version 3.0.124 to take their place.
Two limits matter. Version 3.0.123 alone does not prove a site was compromised. And Rank Math describes the incident as affecting a limited number of users. The material we reviewed does not explain how the malware entered the package.
Why the clean version is not enough
Rank Math says the tainted files could compromise a site once the plugin was activated. The malware can rebuild a hidden backdoor, a secret way back in, when someone visits the website.
That is why updating falls short. Version 3.0.124 swaps out the bad package. It leaves alone any files, administrator accounts or scheduled tasks the malware may already have planted elsewhere. Think of replacing a recalled part in a machine. The new part is sound, but damage the old one did while running stays in place.
The exposure also reaches beyond the website. Rank Math advises assuming that any credentials and secrets the site could access may have been exposed. That includes WordPress passwords, database credentials and API keys.
What the malware leaves behind
Rank Math lists signs to investigate. Their absence does not prove a site is clean. They include:
Three entries in the WordPress wp_options database table named _uf6qdn2hmm, t8krdk990phb and _np5pvf754c. Also look for administrator accounts you do not recognise whose names begin with wpsupport_, and any account registered to an @wp-mail[.]net address.
A file at wp-includes/class-wp-cache-util.php, which Rank Math says is not a legitimate WordPress core file. Also check for PHP files in unexpected places, such as wp-content/mu-plugins/ or the uploads directory.
.htaccess rules that let .cache files run as PHP. Also check the web server user's scheduled system jobs for the tag #ms6v46.
The order of recovery matters
Rank Math's guidance depends on what happened to the copy. If an affected copy was installed and activated, treat the site as compromised. If it was installed but never activated, delete the plugin files, install 3.0.124 and scan. If it was downloaded but never installed, Rank Math says this incident alone gives no sign of compromise.
For compromised sites, Rank Math first asks owners to stop the backdoor from rebuilding itself. Delete the entire rank-math-pro folder, because deactivating is not enough. Delete the three database entries. Block outgoing connections to rank1cdn[.]com if the host or firewall allows it.
Only then should teams hunt for other files. Rank Math's preferred route is to roll the site and its database back to a backup taken before 20:02 UTC on October 15, 2026. It then asks owners to scan, replace credentials and install 3.0.124 from their Rank Math account.
Credential replacement is easy to overlook, because a restore feels like a clean slate. Rank Math says changing passwords is essential even after a restore. Plan to work through every system the site could talk to. Rank Math names the database, WordPress's own security keys and salts, payment and email accounts, the hosting dashboard, and remote file or shell access.
One more detail is worth passing on. Rank Math says it will not email login or download links. Treat any such message as suspicious.
Questions to put to your team
First: do we run Rank Math SEO PRO on any site, and when was each copy obtained? The answer decides whether this is an incident or a non-event.
Second: do we have a backup dated before 20:02 UTC on October 15, 2026 that we can trust to be clean? Third: who can replace every credential the site could reach, and how long would that take? Fourth: can anyone check scheduled tasks and writable folders outside the website directory?
A patch replaces the file. Only a recovery replaces the trust.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Wordfence.
