Rank Math PRO Shipped a Backdoor Under a Version Number That Was Already Clean. Updating Does Not Undo It.
If your WordPress site runs Rank Math PRO and you downloaded or updated it between 20:02 UTC on October 15 and 07:12 UTC on October 16, treat the site as compromised. Rank Math says copies of PRO 3.0.123 served from its own site in that window carried a backdoor. The clean version is 3.0.124. Updating to it does not remove what the backdoor already planted. The free Rank Math plugin on WordPress.org is not affected, according to the vendor.
We hold the one network indicator the vendor published, rank1cdn[.]com, in our feed. We added it on October 19, from the vendor's notice. That is three and a half days after the window closed. We had nothing on it before that, and our pre-install check does not cover WordPress plugins at all. Both of those are in this post.
What happened
Rank Math published an incident notice on October 16. It says PRO 3.0.123 files served from rankmath.com, by direct download and by in-dashboard update, contained malware for 11 hours and 10 minutes. The vendor removed the files and released 3.0.124. It has not said how the attacker got into its distribution, or how many sites received a bad copy. It calls the number "limited."
Here is the detail that matters most. Rank Math's changelog dates the genuine 3.0.123 to October 7. The poisoned copies used the same version number nine days later. So the version on your Plugins screen does not tell you whether you got the clean file or the bad one. Only the time you got it does.
Patchstack lists the incident as CVE-2026-111862, scored 9.8, published October 17, citing a Wordfence entry. Patchstack also says no virtual patch rule is possible, because the attack was on Rank Math's own infrastructure. A firewall rule cannot tell a poisoned official update from a clean one.
What the backdoor does
Per the vendor notice:
It runs once the plugin is activated. A copy that was downloaded but never activated is a lesser problem.
It rebuilds its hidden PHP backdoor when someone visits the site. Deleting one bad file buys you a page load. Deactivating the plugin is not enough.
It hides PHP in wp-content/mu-plugins, other plugins' folders, the inc, includes and lib folders of non-default themes, and Rank Math's own includes folder.
It adds a fake core file, wp-includes/class-wp-cache-util.php. WordPress core has no such file.
It creates admin accounts with usernames starting wpsupport_ and emails ending in @wp-mail[.]net.
It writes three rows to wp_options: _uf6qdn2hmm, t8krdk990phb and _np5pvf754c.
It adds crontab entries tagged #ms6v46, and .htaccess rules that let .cache files run as PHP.
Its code uses base64 with XOR loops (key xmmqhn), proc_open, and PHP-FPM socket calls. That last part means commands on the server, not just inside WordPress.
It talks to rank1cdn[.]com.
Secondary write-ups add that it harvests WordPress credentials, database passwords and API keys, and can add SSH authorized_keys entries. The vendor's own cleanup list includes reviewing authorized_keys, so treat that as likely.
One thing we checked ourselves
We looked up the domain registration. rank1cdn[.]com was registered on October 14 at 19:31 UTC, through NiceNIC, with Cloudflare name servers. That is about 24 and a half hours before the window opened. The C2 was ready before the poisoned build shipped.
It resolves to Cloudflare addresses. We are not adding those IPs to the feed. They are shared by many unrelated sites, and blocking them would break the internet for our subscribers. Block the domain, not the IPs.
On October 20, Quad9's filtering resolver already refuses the domain. Its unfiltered resolver still answers. We cannot say when Quad9 started blocking, so we claim no date for it.
What we hold, and what we don't
rank1cdn[.]com is in our iocs index at confidence 85, source manual-batch-rankmath-2026-10, added October 19 at 17:26 UTC. The record says it came from the vendor notice. It is not our observation.
It is in our default domains.csv, read back today.
Nothing else in our corpus mentions it. No third-party feed in our index had it earlier. Our cross-index correlation returns this single record.
Our lead on this: none. The vendor found it and published it. We carried it.
The honest gap is the pre-install one. Our check-package tool answers "is this dependency known bad" for npm, PyPI, RubyGems and GitHub Actions. We asked it about this plugin today. It rejected the request, because WordPress plugins are not a supported ecosystem. Even if it were, this one would have been hard. The bad file came from the real vendor, under a real version number, with nothing to compare it against. WordPress.org publishes checksums for free plugins. Premium plugins like this one usually have none.
The feed helps after the fact. A site that blocks outbound connections to rank1cdn[.]com cuts the backdoor's line home. Many small hosts do not let you filter outbound traffic, so ask yours, or use a filtering DNS resolver on the server if you can.
What to do if you run Rank Math PRO
Start here, in this order. The order matters because the backdoor rebuilds itself.
Check when you got 3.0.123. If you installed or updated PRO between 20:02 UTC October 15 and 07:12 UTC October 16, and it was active, assume compromise. If you aren't sure, assume it. In US time, the window opened at 4:02 PM Eastern on October 15.
If you have a backup from before 20:02 UTC October 15, restore files and database from it. This is the vendor's recommended path, and the cleanest one.
If you must clean by hand, first delete the rank-math-pro folder entirely. Then delete the three wp_options rows named above. Then block rank1cdn[.]com if your host allows it.
Look for admin accounts you didn't create. With WP-CLI, run wp user list --role=administrator. Delete anything starting wpsupport_ or using an @wp-mail[.]net address.
Delete wp-includes/class-wp-cache-util.php, then run wp core verify-checksums and reinstall core if anything fails.
Check .htaccess for rules about .cache files, look for PHP files in uploads, and check mu-plugins.
Check the server's crontab for #ms6v46, run wp cron event list, and look at SSH authorized_keys. If you are on shared hosting and can't see these, open a ticket and ask your host to.
Reinstall every plugin and theme from its official source.
Rotate everything: WordPress passwords, the database password in wp-config.php, the security keys and salts, API keys, SMTP passwords, hosting, FTP and SSH logins, and admin 2FA.
Install 3.0.124 by logging in at rankmath.com directly. Rank Math says it will never email you a download or login link. An email offering one right now is a second attack, not help.
Scan with Wordfence or Sucuri, and check again over the next few days whether removed files come back.
If the plugin was installed but never activated, the vendor says delete it, install 3.0.124 and run a scan.
What this adds up to
Most WordPress plugin advice is "keep it updated." This week the update was the attack, the version number was a lie, and updating again fixes the plugin but not the site. The useful defenses here were older and duller: a backup from before the window, an admin list you actually look at, and the ability to block a domain on the way out.
The free key that pulls our domain list, at any confidence threshold you choose, is at https://analytics.dugganusa.com/stix/register?utm_source=blog&utm_campaign=rank-math-pro-backdoor
If this was useful, or if it wasn't, the rating widget below takes ten seconds and is the only way we know.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=rank-math-pro-shipped-a-backdoor-under-a-version-number-that-was-already-clean-updating-does-not-un
Comments