1 (888) 897-3611 Book a call

Threat advisory · Multiple

A Rank Math PRO download carried a backdoor: how to check your WordPress site

Rank Math PRO 3.0.123, downloaded Oct 15-16, 2026, held a backdoor. If it was activated, restore a clean backup, change passwords and install 3.0.124.

By happier IT 5 min read

Copies of the paid WordPress plugin Rank Math PRO, version 3.0.123, downloaded or updated between the evening of October 15 and the morning of October 16, 2026 (UTC), contained a backdoor. If your website runs Rank Math PRO, check the version and update date now. If 3.0.123 was activated, treat the site as compromised.

What happened

Rank Math, the maker of a popular WordPress SEO (search engine optimization) plugin, published a security notice on October 16, 2026. It said some copies of Rank Math PRO 3.0.123 “contained malware that could compromise your website if the plugin was activated,” and that it had removed the affected files and released a clean version, 3.0.124.

The affected window ran from 20:02 UTC on October 15 to 07:12 UTC on October 16, 2026, about 11 hours. The vulnerability record for the incident, CVE-2026-111862 (a CVE is a public ID for a security flaw), published October 19 and assigned by security firm Wordfence, says this covers copies “downloaded or updated” in that window. It rates the issue 9.8 out of 10.

According to Rank Math’s notice and reporting by BleepingComputer and The Hacker News on October 19:

  • Once activated, the malware sets up lasting access and talks to an outside domain, rank1cdn[.]com.
  • It can recreate its hidden backdoor whenever someone visits the site, so deleting files alone may not work.
  • It can expose the secrets the website holds, such as database passwords and API keys (the credentials that connect a site to other services).
  • Rank Math lists signs including rogue administrator accounts, extra code in other plugins and themes, and new scheduled tasks.

Rank Math describes the number of affected users as “limited.” It has not said how many sites received the malware or how the files got into its systems.

Who is affected

Websites running Rank Math PRO that downloaded or updated to 3.0.123 during the window. Earlier copies are outside the incident, and Rank Math says free-plugin users need to take no action.

Rank Math sorts users into three groups:

  • Installed and activated 3.0.123 in the window: treat the site as compromised.
  • Installed but never activated: lower risk. Delete the plugin, install 3.0.124 and scan the site.
  • Downloaded but never installed: Rank Math says this alone gives no sign of compromise.

What to do now

If your website runs Rank Math PRO

  1. Check the version and the date it was updated. If you’re not sure, ask whoever looks after your website.
  2. If 3.0.123 was activated, restore from backup. Rank Math recommends restoring files and the database from a backup made before 20:02 UTC on October 15, 2026 (4:02 p.m. Eastern, 1:02 p.m. Pacific). This is where a tested backup and disaster recovery plan pays off.
  3. Change every password and key, even after restoring. That means WordPress and hosting logins, the database password, WordPress security keys and salts, API keys, email-sending credentials, and file transfer and server access. Re-check two-factor sign-in for administrators.
  4. Install the clean version, 3.0.124, by going to rankmath.com directly and signing in. Rank Math says it never sends login or download links by email, so don’t follow emailed links claiming to fix this.
  5. Scan and watch. Run a security scan, check for administrator accounts starting with wpsupport_ or using an @wp-mail[.]net email address, look for wp-includes/class-wp-cache-util.php, and block outbound traffic to rank1cdn[.]com if you can. If removed files come back, get help from your host or a security professional.

If there’s no clean backup

Follow Rank Math’s manual clean-up steps in order. Deleting the whole rank-math-pro folder and three specific database entries comes first, or the backdoor can rebuild itself.

What this means for organizations in BC and Alberta

A backdoored website can expose what it stores or connects to, such as form submissions and customer accounts. If personal information was reachable, a compromise may also be a privacy breach.

  • Organizations covered by PIPEDA (the Personal Information Protection and Electronic Documents Act, Canada’s federal private-sector privacy law): report to the Privacy Commissioner of Canada and notify affected people as soon as feasible when a breach creates a real risk of significant harm. Keep a record of every breach for 24 months, reportable or not.
  • Alberta private organizations (Alberta PIPA, the Personal Information Protection Act): notify Alberta’s Office of the Information and Privacy Commissioner without unreasonable delay when a reasonable person would consider there is a real risk of significant harm. The commissioner encourages organizations to notify affected individuals promptly as well, rather than waiting to be told to.
  • BC private organizations (BC PIPA): there is currently no mandatory breach notification requirement, but BC’s Office of the Information and Privacy Commissioner accepts voluntary reports.

Organizations in British Columbia and Alberta should also check any sector rules and cyber insurance terms that apply to them.

This is the second WordPress plugin issue this month, after the Ninja Forms flaw earlier in October. This time the malware arrived through the vendor’s own download, not a bug in the plugin’s code.

How happier IT helps

Websites often sit outside regular IT checks. Our vulnerability management work keeps track of what’s installed and what needs attention, websites included. If you’d like a calm second look at where you stand, our free IT assessment is a good place to start.

Sources

More from the feed

Other incidents we've written up.

Want to know what this would look like for you?

A 30-minute call. No slides, no audit fee, no obligation. We ask what is breaking and tell you honestly whether we are the right fit.

Book a 30-minute call Get a free IT assessment

Or call 1 (888) 897-3611