Rank Math PRO Compromised: Backdoored 3.0.123 Download, What to Check Now

News · 27 October 2026

If you use the paid Rank Math PRO SEO plugin and updated it in mid-October, check your site today. Rank Math has confirmed that Rank Math PRO was compromised in a supply-chain attack: some copies of version 3.0.123 downloaded from its official website carried hidden backdoor malware.

What happened

As BleepingComputer reported on 19 October 2026, the vendor says a limited number of users who downloaded Rank Math PRO 3.0.123 between 15 October 20:02 UTC and 16 October 07:12 UTC (about 1:32 AM to 12:42 PM IST on 16 October) received a tampered build. If activated, it could compromise the site.

• Only Rank Math PRO was affected. The free Rank Math SEO plugin from WordPress.org was not.
• The vendor removed the bad files and released a clean Rank Math PRO 3.0.124.
• The malware keeps persistent access, contacts the domain rank1cdn[.]com, and recreates hidden backdoors when someone visits the site.
• It can expose database credentials, API keys and other secrets the web server can read.

What it means for site owners

If you installed and activated the bad 3.0.123 build during that window, Rank Math says to treat the site as compromised. Simply updating or deactivating the plugin does not remove the malware. If you never used Rank Math PRO, or only use the free version, this incident does not affect you.

Warning signs to look for

BleepingComputer lists these indicators linked to the attack:

• A file named wp-includes/class-wp-cache-util.php
• Administrator users whose username starts with wpsupport_ or with an @wp-mail.net email
• A database option named _np5pvf754c
• A cron entry with the marker #ms6v46

If you have SSH or cPanel Terminal access, these read-only checks help:

ls -la wp-includes/class-wp-cache-util.php
wp user list --role=administrator --fields=user_login,user_email
wp option get _np5pvf754c
crontab -l | grep ms6v46

What to do

1. Check your version and date. In WordPress, go to Plugins and see if Rank Math PRO shows 3.0.123, and when you updated it.
2. Installed but never activated? Delete the plugin, install the clean 3.0.124, then scan the site.
3. Activated it? Restore files and database from a clean backup taken before 15 October, if you have one.
4. No clean backup? Follow Rank Math’s manual cleanup: delete the whole plugin folder, remove the malicious database entries, then look for other backdoors, unknown admin users, changed files and scheduled tasks.
5. Rotate everything: WordPress passwords, database password, API keys and the salts in wp-config.php.
6. Block outbound connections to rank1cdn[.]com if your firewall allows it.

Our hacked WordPress cleanup checklist walks through the detect, clean and harden steps in more detail.

Need a safer home for your site?

Regular backups are what make an incident like this a quick restore instead of a long cleanup. Our WordPress hosting is built for WordPress sites. For help, email support@shohost.com or WhatsApp +91 94880 91432 (9 AM to 12 midnight IST).

Source: BleepingComputer, 19 October 2026, citing Rank Math’s advisory.