WordPress SEO plugin Rank Math PRO turned its own update channel into a backdoor pipeline

Rank Math disclosed on October 16 that the paid edition of its popular WordPress SEO plugin briefly became a delivery channel for malware. Every copy of Rank Math PRO downloaded from rankmath.com or pushed as an update between 20:02 UTC on October 15 and 07:12 UTC on October 16 was tainted. Any site that installed and activated such a build should be treated as compromised, and the backdoor, the company says, can rebuild itself whenever a visitor loads the site.

The version number gives nothing away: the incident is tied to a time window, not to release 3.0.123. A 3.0.123 copy obtained before 20:02 UTC on October 15 is unaffected, and simply updating to the clean 3.0.124 does not fix the problem — it replaces the plugin files but leaves alone any stray files, administrator accounts, and scheduled tasks the malware may have planted elsewhere, Wordfence warned.

What the malware does

Neither Rank Math nor Wordfence has published an analysis of the code, and no one is named as the culprit. What is known is that the attacker may have scattered PHP backdoors across other plugins' folders, theme directories, and the mu-plugins folder, created administrator accounts, added a fake WordPress "core" file, rewritten .htaccess so that .cache files run as PHP, and planted cron jobs and SSH keys. Any password, database credential, or API key the site could reach should be assumed exposed.

Wordfence assigned the incident CVE-2026-111862 and rated it 9.8 out of 10. Patchstack classifies it as a backdoor and notes that, because the attack hit Rank Math's own systems, no protective rule is possible.

How to recover

The preferred path is a restore from a backup of the site and database made before 20:02 UTC on October 15, followed by changing every password. Where no clean backup exists, manual cleanup runs in a fixed order: first delete the entire rank-math-pro folder (deactivating is not enough), then remove specific entries from the wp_options table, and block outgoing connections to rank1cdn[.]com. Only then does the hunt for other traces begin — suspicious PHP files, usernames starting with wpsupport_, rogue .htaccess rules, crontab entries, and stray SSH keys. Rotating all passwords and keys is mandatory in every case, even after a restore.

The free Rank Math SEO plugin on WordPress.org (over 4 million installs) is not named in the notice. The domain owners are told to block, rank1cdn[.]com, was registered on October 14 — about a day before the window opened.

A recurring pattern

Rank Math has not said how the malicious files reached its update system or how many customers received them. This is at least the third time this year that a premium WordPress plugin's own update channel has shipped backdoored builds: Smart Slider 3 Pro and ShapedPlugin's plugins were hit earlier — and in the latter case a package that had shipped clean was later tampered with under the same version number. That is precisely the trap Rank Math's customers now face.

Source: The Hacker News