Rank Math PRO distributed through rankmath.com was infected by malware in updates between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026, potentially enabling a backdoor on visiting sites.

Manual cleanup should include scanning for backdoors and malicious changes across mu-plugins, other plugins, theme folders, WP core files, server configurations, and any new administrator accounts, followed by integrity checks of WordPress core and plugins after cleanup.

Context from Wordfence and Patchstack suggests backdoors, new admin accounts, modified .htaccess, added SSH keys, and other footholds, with the incident rated highly severe (CVE-2026-111862, 9.8/10 by Wordfence).

The infection affected only the PRO plugin, not the free Rank Math SEO plugin on WordPress.org, with details depending on how the plugin was obtained and activated during the window.

After verification of a clean site, users should change all passwords and reinstall Rank Math PRO using a clean copy.

This marks at least the third 2026 incident where a premium WordPress plugin’s vendor update channel delivered backdoored builds, underscoring ongoing supply-chain security risks.

Rank Math released a clean version, Rank Math PRO v3.0.124, and warned that version 3.0.123 should be treated as compromised.

The security notice also cautioned that installing the clean version does not remove all traces of compromise, such as infected files, new admin accounts, or scheduled tasks left elsewhere on the server.

Malicious code could allow attackers to take over sites when the plugin is activated.

The malware may recreate a hidden backdoor on page visits and could persist across cleanups, potentially exposing credentials and API keys.

Rank Math has not disclosed how tainted builds entered its update system, how many customers were affected, whether automatic updates occurred, or the exact hashes of clean vs tainted packages; the domain rank1cdn.com involved was registered shortly before the window, suggesting premeditation.

Recovery guidance emphasizes restoring from pre-incident backups and reinstalling 3.0.124; if no clean backup exists, proceed with a structured manual cleanup including deleting the rank-math-pro folder, removing suspicious wp_options entries, and blocking rank1cdn.com outgoing connections.