ET RU
Get a quote
WordPress maintenance Hacked site cleanup
WordPress websites WooCommerce shops SEO Automation Extra development Web hosting Portfolio
Security plugin Pricing Security tips
Get a quote My site is hacked
Home / Security tips / Website security
October 18, 2026

Rank Math PRO 3.0.123 Malware: Why 3.0.124 Alone Won’t Clean Your Site

Updated October 18, 2026

Category: Website security

Your site auto-updated overnight on 15 October. By morning, Rank Math PRO shows 3.0.123. Should you worry?

Maybe. Some copies of Rank Math PRO 3.0.123 carried malware during an 11-hour download window. Timing matters more than the version number. If the bad copy ran on your site, updating to 3.0.124 won’t remove everything it may have left behind.

Rank Math PRO 3.0.123 malware: what happened

Rank Math says a limited number of users downloaded an affected copy. It hasn’t said how many sites got it, or how the malicious files got there. Wordfence lists the incident as CVE-2026-111862, rated 9.8 out of 10. The affected download window was:

  • UTC: 15 October 2026, 20:02 to 16 October, 07:12
  • Central Europe (CEST): 15 October, 22:02 to 16 October, 09:12
  • Tallinn, Helsinki and Riga (EEST): 15 October, 23:02 to 16 October, 10:12

This covers downloads and updates, including automatic updates. The free Rank Math plugin from WordPress.org isn’t named in the incident. This concerns the paid PRO add-on, delivered from Rank Math’s servers in the rank-math-pro folder.

Rank Math removed the affected files and released clean version 3.0.124 on 16 October. Go directly to rankmath.com and log in. Don’t use an email download link: Rank Math says it never sends login or download links by email. Some users may need to reset their Rank Math account password first.

How to tell whether your copy was affected

Version 3.0.123 alone proves nothing. It first came out on 7 October, so a copy installed before the affected window was a normal build. You need to find out when your copy arrived.

  • Open Plugins and check whether Rank Math PRO is, or recently was, on 3.0.123. That isn’t proof of infection.
  • Check modification dates for files in rank-math-pro using your host’s file manager or FTP. Check the displayed timezone; many servers use UTC. Dates help, but aren’t a guaranteed install record.
  • Look at an activity log if you have one, your host’s logs, and automatic-update emails sent to your WordPress admin address. WordPress itself doesn’t show an “installed on” date.
  • If Rank Math emailed you about an affected download, follow its steps even if you’re now on another version. Verify the message by signing in at rankmath.com directly, never through its links.

Rank Math splits this into three cases. Installed and activated the affected copy? Treat the site as compromised and do a full recovery. Installed it but never activated it? Delete the plugin files, install 3.0.124 from your Rank Math account, then scan. Downloaded it but never installed it? That alone doesn’t indicate compromise. Can’t establish which case applies? Ask Rank Math support or treat the site as affected.

If the bad copy was active, restore first

My pick is Rank Math’s recommended route: restore both site files and database from a backup made before 15 October 2026 at 20:02 UTC. Then run a security scan – Rank Math suggests Wordfence or Sucuri – change credentials, and then install 3.0.124 from your Rank Math account.

Why the fuss? Once activated the malware could contact rank1cdn.com, create unauthorized administrators and leave persistent access. It could rebuild a hidden backdoor when someone visited the site. Extra files, scheduled tasks and server-level changes might remain. Updating Rank Math only replaces the plugin package; it doesn’t undo those changes. A clean-looking Plugins screen isn’t a cleanup report.

If you’re restoring with UpdraftPlus, update it to 1.26.11 or newer first. That release fixed restore-time security bugs this week. Keep the compromised site’s logs and a copy for the investigation, if you can do that without delaying recovery.

Manual cleanup has to happen in order

No pre-window backup? Get experienced help. The backdoor can rebuild on page loads, so hunting files before cutting off its starting point may waste the afternoon. Our hacked WordPress cleanup guide covers the wider process.

  1. First, do all three: delete the entire rank-math-pro folder – deactivating isn’t enough. Delete rows in wp_options whose option_name is _uf6qdn2hmm, t8krdk990phb or _np5pvf754c. Ask your host to block outgoing connections to rank1cdn.com if they can.
  2. Then investigate what remains: check for unknown administrators starting wpsupport_ or using emails ending @wp-mail.net; wp user list --role=administrator can help. Look for wp-includes/class-wp-cache-util.php – Rank Math says it isn’t a real core file. Remove it, verify core with wp core verify-checksums, and reinstall core from the official source.
  3. Check for suspicious PHP in wp-content/mu-plugins/, other plugin folders, non-default themes’ inc/, includes/ and lib/ folders, Rank Math’s includes/, and uploads/. PHP in uploads deserves particular attention. Have a developer check code using base64_decode with XOR loops, xmmqhn, proc_open or PHP-FPM socket code.
  4. Review root and subfolder .htaccess rules allowing .cache files to run as PHP, plus any .cache files containing PHP. Check system cron jobs tagged #ms6v46 and WordPress events with wp cron event list. Ask your host to inspect SSH authorized_keys, other users’ crontabs and running processes, especially on shared hosting.

Clues, not a definitive test. Their absence doesn’t prove the site is clean.

Rotate credentials, even after a restore

Assume secrets the site could reach were exposed. Rank Math says to change them even if you restored an older backup:

  • All WordPress passwords, plus the database username and password in wp-config.php.
  • WordPress security keys and salts in wp-config.php; review and reset administrator two-factor authentication.
  • Payment gateway keys, SMTP credentials, API keys, other secrets stored in settings or config files, and secrets in environment variables.
  • Hosting control panel, FTP/SFTP and SSH credentials.

Then scan again. Run wp core verify-checksums and wp plugin verify-checksums --all, knowing checksum checks may not cover premium plugins; compare those against clean vendor copies. Watch outgoing connections for days. If removed files return, the cleanup isn’t finished.

Why the new WordPress.org checks didn’t catch this

Since June 2026, WordPress.org has held every plugin and theme release for a cooldown, currently six hours, and scanned it with AI models and Jetpack Scan. Since 9 September, it has automatically blocked high-risk releases. We covered those WordPress plugin update checks earlier.

But those checks cover only what WordPress.org distributes. Rank Math PRO updates from the vendor’s servers, outside that system, like many paid plugins and themes. That’s the uncomfortable part: a firewall rule couldn’t prevent an affected vendor download. Patchstack makes that point plainly.

For business-critical sites, I’d keep daily off-server backups you can restore to a specific date, plus an activity log, and I’d consider delaying automatic updates for premium plugins by a day – though security fixes can need speed, so I wouldn’t make that a blanket rule. It’s a trade-off.

What to do today

If your affected copy was active, our hacked site cleanup service can handle the recovery. For ongoing backups, updates and monitoring, that’s what our WordPress maintenance service is for.

Right now, open Plugins. Check the Rank Math PRO version, then check when the files in rank-math-pro arrived. That second check is the one that definitly changes what you do next.