# Rank Math PRO Plugin Compromised in Supply-Chain Attack

> Malicious code was distributed in some downloads of Rank Math PRO version 3.0.123, exposing WordPress sites to backdoors and data theft.

By PrimaryBrief newsroom · Published 2026-10-22T19:59:58.629024Z
Canonical: https://primarybrief.com/article/rank-math-pro-plugin-compromised-in-supply-chain-attack-c0e7a392

WordPress SEO plugin Rank Math PRO was compromised in a supply-chain attack between October 15, 2026, 20:02 UTC and October 16, 2026, 07:12 UTC, leading to the distribution of malware-infected versions of its software with a critical CVSS score of 9.8 [1][9]. The incident means that a limited number of users who downloaded and activated the affected software during this window risk having their websites exploited, potentially leading to the exposure of sensitive data like passwords and API keys, and persistent attacker access [2][7][12].

## What the records show

Malicious code was embedded within a subset of downloads for Rank Math PRO version 3.0.123, distributed from the official vendor website [1][6]. This incident has been assigned CVE-2026-111862, carrying a critical CVSS score of 9.8 [9]. The malware was designed to establish persistent backdoors on compromised websites [7]. Upon activation, the malicious plugin could communicate with an attacker-controlled domain, `rank1cdn.com`, and recreate hidden backdoors whenever an infected site was visited [7][8]. Registry records indicate the domain `rank1cdn.com` was registered on October 14, 2026, approximately one day before the compromise window began [10][13].

The malware had capabilities to expose a wide array of sensitive information, including WordPress passwords, database credentials, API keys, security keys and salts stored in `wp-config.php`, payment gateway keys, SMTP credentials, hosting control panel access, and FTP/SFTP/SSH credentials [7][12]. Beyond data exfiltration, the malware could also create unauthorized administrator accounts, often with usernames prefixed `wpsupport_` or email addresses ending in `@wp-mail.net` [7][12]. It was also capable of dropping fake WordPress core files, such as `wp-includes/class-wp-cache-util.php`, modifying `.htaccess` files to execute `.cache` files as PHP, adding malicious entries to the WordPress options table (`_uf6qdn2hmm`, `t8krdk990phb`, `_np5pvf754c`), and scheduling system cron jobs tagged `#ms6v46` [7][12]. Attackers could also make changes outside the WordPress installation, modifying SSH `authorized_keys` files or other system users' crontabs [7][12].

## The Timeline

The domain `rank1cdn.com`, implicated in the attack, was registered on October 14, 2026 [10][13]. The distribution of malicious software began on October 15, 2026, at 20:02 UTC [1][2]. This window of compromise continued until October 16, 2026, at 07:12 UTC, lasting 11 hours and 10 minutes [1][3]. Rank Math officially acknowledged the security issue on October 16, 2026 [2][10]. The company then removed the affected files and released a clean version, Rank Math PRO v3.0.124, on the same day [2][3].

## What changed and for whom

Rank Math clarified that only users of the premium Rank Math PRO plugin were affected by this incident [2][5]. The free version of the plugin, available on WordPress.org, remained secure and its users require no action [2][5]. Rank Math stated that several hundred customers downloaded a compromised copy of its PRO plugin [13]. For users who downloaded or updated to version 3.0.123 during the affected 11-hour, 10-minute window, Rank Math provided detailed recovery steps [2][3]. If version 3.0.123 was installed and activated during the compromise window, the website should be treated as compromised [2][6]. If the plugin was installed but not activated, users are advised to delete affected files, install the clean version 3.0.124, and run a security scan [2][6]. If only downloaded but not installed or activated, no compromise is indicated from this incident alone [2][12].

Recommended recovery actions for compromised sites include restoring from a clean backup created before October 15, 2026, at 20:02 UTC, running a security scan with tools like Wordfence or Sucuri, changing all passwords and credentials, and installing the clean version 3.0.124 [2][7]. For manual cleanup without a clean backup, steps involve deleting the entire `rank-math-pro` directory, removing specific malicious entries from the WordPress options table (`_uf6qdn2hmm`, `t8krdk990phb`, `_np5pvf754c`), blocking outbound connections to `rank1cdn.com`, and meticulously searching for and removing suspicious files, unauthorized administrator accounts, modified `.htaccess` files, and scheduled tasks [5][7].

## What Rank Math said

Rank Math acknowledged the security issue on October 16, 2026, stating that the affected files were immediately removed and a clean version, Rank Math PRO v3.0.124, was released [2][3]. The company clarified that only users of the premium Rank Math PRO plugin were affected, while the free version available on WordPress.org remained secure [2]. Rank Math Operations Director Uzair Nazeer stated, "We know how much our customers rely on Rank Math, and we apologize for the worry this has caused. Our team is here to help anyone who's been affected" [13]. The company also provided detailed recovery steps to its users [2].

## What we could not confirm

PrimaryBrief could not confirm how the malicious files entered Rank Math’s download and update system [10]. It is also unconfirmed whether automatic updates delivered the malware [10]. The hashes of the clean and tainted packages have not been publicly disclosed [10].

## Evidence cited
1. Some Rank Math SEO PRO 3.0.123 downloads contained malware (Wordfence) — https://wordfence.com/blog/2026/10/some-rank-math-seo-pro-3-0-123-downloads-contained-malware/
2. Rank Math PRO 3.0.123 Security Incident: How to Secure Your Website (Rank Math) — https://rankmath.com/kb/rank-math-pro-3-0-123-security-incident/
3. Malicious Rank Math PRO Plugin Downloads May Leave WordPress Sites Backdoored Even After Updating | eSecurityPlanet (eSecurityPlanet) — https://esecurityplanet.com/threats/wordpress-rank-math-pro-malware/
4. Rank Math PRO 3.0.123 Incident: How to Recover an Affected Site (WP Umbrella) — https://wp-umbrella.com/blog/rank-math-pro-3-0-123-incident-recovery-guide/
5. Rank Math PRO Compromised: WordPress Sites at Risk from Backdoored Plugin (GBHackers) — https://gbhackers.com/rank-math-pro-compromised/
6. WordPress SEO plugin Rank Math compromised to backdoor websites (BleepingComputer) — https://www.bleepingcomputer.com/news/security/wordpress-seo-plugin-rank-math-compromised-to-backdoor-websites/
7. Hackers Hijack WordPress SEO Plugin Rank Math PRO to Deliver Backdoor (SecurityWeek) — https://www.securityweek.com/hackers-hijack-wordpress-seo-plugin-rank-math-pro-to-deliver-backdoor/
8. Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code : r/Wordpress (Reddit) — https://www.reddit.com/r/Wordpress/comments/17ahv42/rank_math_seo_pro_30123_unauthenticated_embedded/
9. WordPress Rank Math SEO PRO Supply-Chain Compromise Exploited in the Wild (SecurityOnline.info) — https://securityonline.info/wordpress-rank-math-seo-pro-supply-chain-compromise-exploited-in-the-wild/
10. Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor (The Hacker News) — https://thehackernews.com/2026/10/popular-wordpress-seo-plugin-rank-math.html
11. WordPress Rank Math SEO PRO Plugin 3.0.123 is vulnerable to a high priority Backdoor (Patchstack) — https://patchstack.com/database/vulnerability/seo-by-rank-math-pro/wordpress-rank-math-seo-pro-plugin-3-0-123-is-vulnerable-to-a-high-priority-backdoor
12. Rank Math PRO compromised with malware, self-restoring backdoors (Cyber Kendra) — https://www.cyberkendra.com/2026/10/rank-math-pro-compromised-with-malware.html
13. Rank Math Pro customers exposed to malware after supply chain attack - The Repository (The Repository) — https://therepository.email/news/rank-math-pro-supply-chain-attack
14. Rank Math PRO 3.0.123 Backdoor: Clean Up After Supply Chain Attack (Ecommerce Paradise) — https://ecommerceparadise.com/rank-math-pro-compromised-with-backdoor/
15. Security Alert: Rank Math PRO Supply-Chain Compromise & Backdoor Vulnerability - FreshySites (FreshySites) — https://freshysites.com/security-alert-rank-math-pro-supply-chain-compromise-backdoor-vulnerability/