Rank Math has disclosed a supply-chain compromise in its paid WordPress SEO plugin, warning that Rank Math PRO 3.0.123 packages distributed during an 11-hour window contained malware capable of installing a hidden backdoor. The affected files were downloaded from Rank Math’s website or delivered through updates between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026, according to the vendor’s security advisory.
The incident affects Rank Math PRO only; the free Rank Math SEO plugin was not affected. Rank Math said it removed the malicious files and released clean version 3.0.124. Sites that installed and activated version 3.0.123 during the exposure window should be treated as compromised, while users who downloaded the file but did not install or activate it have no indication of compromise from this incident alone, the company said.
The malware can recreate its backdoor whenever someone visits an infected site, making a routine plugin upgrade or manual deletion insufficient on its own. Rank Math’s indicators include connections to rank1cdn.com, suspicious administrator accounts beginning with wpsupport_, malicious entries in the WordPress wp_options table, PHP files in unexpected directories and a fake WordPress core file named wp-includes/class-wp-cache-util.php.
Rank Math recommends restoring the website and database from a backup created before 20:02 UTC on October 15 where possible, then scanning the restored installation and installing 3.0.124 from the company’s account portal. For sites that cannot be restored, administrators should first delete the entire rank-math-pro directory, remove identified malicious database entries, block outbound access to rank1cdn.com where feasible and investigate plugins, themes, uploads, cron jobs, administrator accounts, SSH keys and server locations writable by the web process.
Because the compromised plugin may have exposed secrets accessible to the site, the vendor also advises changing WordPress, database, hosting, FTP, SFTP and SSH credentials, regenerating WordPress salts and security keys, and replacing API, payment, SMTP and other service credentials. The advisory does not assign a CVE, provide a CVSS score or attribute the operation to a named threat actor, and it does not report confirmed exploitation beyond the compromise risk to sites where the malicious build was activated.
