Rank Math warns of backdoor in compromised PRO plugin downloads

Rank Math warned that copies of its paid WordPress SEO plugin, Rank Math PRO, distributed between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026, contained malware. In an October 16 security notice, the company said sites that installed and activated affected copies should be treated as compromised because the malware could recreate a hidden backdoor when someone visits.

The company said it removed the affected files and released version 3.0.124, which it described as clean. Wordfence warned in an October 17 advisory that installing the replacement would not remove malicious files, administrator accounts or scheduled tasks already placed elsewhere on a server. Its warning makes recovery a separate task from replacing the plugin.

Which Rank Math PRO downloads are covered

Rank Math’s notice defines the affected distribution window by when customers obtained the plugin through downloads or updates. The company dates version 3.0.123 to October 7, before the reported compromise, so its account does not identify every copy carrying that version number as malicious.

Under the notice’s definition, a copy obtained before 20:02 UTC on October 15 falls outside the reported window. The distinction means the version number alone is insufficient to determine whether a particular installation received an affected package.

The notice separates customers into three groups:

• Installed and activated an affected copy: Rank Math advises treating the site as compromised, including when it has subsequently been updated to 3.0.124.
• Installed but never activated it: The company advises deleting the plugin files, installing its replacement release from the customer’s Rank Math account and running a security scan.
• Downloaded but never installed or activated it: The notice does not treat downloading the package alone as evidence that the website was compromised.

The warning concerns the PRO plugin, distributed through Rank Math’s own download and update systems. It does not identify the free edition in the official WordPress plugin directory as affected. Rank Math directs customers who cannot establish whether an affected copy was installed or activated to its support team.

Why replacing the plugin may not remove the backdoor

Rank Math’s description points to persistence beyond the original plugin directory. The notice warns that an attacker may have placed PHP backdoors in other plugins, themes and the must-use plugins directory, created administrator accounts, or added a file masquerading as part of WordPress core.

Other possible changes listed in the recovery guidance include rules allowing files with a .cache extension to execute as PHP, scheduled tasks and SSH keys. These are potential changes administrators are told to investigate, rather than a finding that every affected website contains all of them.

The company’s cleanup instructions prioritize removing components that could restore the backdoor before searching for additional malicious files. That sequence reflects its warning that deleting individual files may not resolve the compromise while the mechanism that recreates them remains active.

Patchstack classifies the incident as a backdoor and says that, because the attack occurred on Rank Math’s own systems, “a rule is not possible for mitigation.” Wordfence’s advisory similarly cautions against treating a plugin update as a complete recovery measure.

Rank Math recommends restoring a clean backup

Rank Math’s preferred recovery route is to restore both the website and its database from a clean backup made before 20:02 UTC on October 15. Its instructions then call for a security scan and replacement of passwords and credentials before installing version 3.0.124 from the customer’s account. Restoring files alone would not satisfy the company’s instructions, which explicitly include the database and credential changes.

For sites without a clean backup, the notice sets out an ordered manual cleanup. It places three actions before the broader search for changes elsewhere on the server:

1. Remove the entire rank-math-pro plugin folder through the hosting file manager or FTP. “Deactivating the plugin alone is not sufficient,” Rank Math’s notice says.
2. Remove entries from the wp_options table whose option_name is _uf6qdn2hmm, t8krdk990phb or _np5pvf754c.
3. Where hosting or firewall controls permit it, block outgoing connections to the destination identified in the security notice.

The company then calls for an examination of other files, accounts and server settings. Its recovery guidance extends beyond the WordPress installation to locations the web server can write to, reflecting the possibility that persistence mechanisms were placed outside the site’s directory.

Files, accounts and credentials included in the checks

Rank Math’s notice identifies several areas for investigation during manual recovery:

• Plugin and theme directories: PHP files in wp-content/mu-plugins/, other plugins, Rank Math’s includes/ directory, and the inc/, includes/ and lib/ directories of non-default themes. The guidance also includes the uploads directory.
• Code patterns: PHP using base64_decode with XOR loops, the key xmmqhn, proc_open or PHP-FPM socket code.
• A purported core file: wp-includes/class-wp-cache-util.php, which the notice identifies as outside the legitimate WordPress core files.
• Administrator accounts: Unexpected accounts, including usernames beginning with wpsupport_.
• Server persistence: Changes to .htaccess that allow .cache files to run as PHP, PHP code inside such files, crontab entries tagged #ms6v46, WordPress scheduled events, SSH authorized_keys files, other users’ crontabs and running processes.

These indicators are not a guarantee that a scan will find every change. Wordfence cautions: “Their absence does not, by itself, prove that a website is clean.”

Rank Math also advises treating secrets accessible to the compromised site as potentially exposed. Its credential-reset guidance applies even after a backup restore and covers WordPress passwords, database credentials in wp-config.php, and the security keys and salts stored in that file.

The list extends to payment gateway, SMTP and other API keys; hosting control panel credentials; FTP, SFTP and SSH access; and secrets stored in environment variables. The recovery guidance also calls for two-factor authentication for administrators. These measures address possible credential exposure without establishing that every listed secret was stolen.

The prescribed checks include a security scan, wp core verify-checksums for WordPress core and wp plugin verify-checksums --all for plugins. The guidance notes that checksum data may be unavailable for premium plugins, limiting what those checks can establish.

Rank Math places installation of its replacement PRO package at the end of the recovery process. The company tells customers to access their accounts directly and says it will never send login or download links by email. Its notice also says some customers may need to reset their account password to regain access, without explaining why.

Questions remain about the distribution compromise

Rank Math has not disclosed how the malicious files entered its download and update systems, how many customers received affected copies, or whether automatic updates delivered them. It also has not published hashes distinguishing the clean and tainted packages. The company says it is taking steps to reduce the risk of similar incidents but has not detailed those measures.

The incident follows other compromises involving vendor-operated WordPress software distribution during 2026. In April, Nextend’s update system distributed a backdoored Smart Slider 3 Pro package for about six hours. In June, ShapedPlugin’s Pro plugins were found to have been backdoored through its update channel, including a package altered under an unchanged version number.

Other incidents involved scripts served through Awesome Motive’s content delivery network in June and BdThemes’ API feed in August. No connection between the attackers responsible for those incidents and the Rank Math compromise has been established.