Rank Math Malware Alert: 7 Steps to Check Your Site's Safety

Rank Math itself has confirmed the worst-case scenario for a WordPress plugin: a supply-chain compromise slipped malware into copies of Rank Math SEO PRO 3.0.123. The incident is tracked as CVE-2026-111862, carries a CVSS score of 9.8 (Critical), and has been observed exploited in the wild. The tainted copies were only distributed during an 11-hour window on October 15–16, 2026 — but if your site downloaded or updated the plugin inside that window and activated it, security researchers say you should treat your site as fully compromised. This guide explains exactly what happened, how to check whether your site is affected, the known infection signs to look for, and the precise recovery steps for every scenario — so you can answer the one question that matters: is my site safe?

What Happened: A Supply-Chain Compromise in Rank Math SEO PRO 3.0.123

On October 16, 2026, Rank Math published a security advisory disclosing that some copies of Rank Math SEO PRO version 3.0.123 distributed through its own update channel contained malware. This is what the security industry calls a supply-chain compromise: instead of attackers breaking into individual websites, the malicious code rode along inside a trusted software update that site owners installed willingly.

That distinction matters enormously. When a plugin as widely deployed as Rank Math SEO PRO — one of the most popular SEO plugins in the WordPress ecosystem — serves a tainted update, the blast radius is not one site but potentially every site that pulled the update during the exposure window. The incident has been assigned CVE-2026-111862 with a CVSS score of 9.8 out of 10 (Critical), and it is listed as exploited in the wild, meaning attackers were actively taking advantage of the compromise rather than merely possessing the capability.

Once the tainted copy is activated on a WordPress site, the malware behaves like a full site-takeover toolkit. According to the technical analysis, it:

Contacts a command-and-control (C2) domain — rank1cdn[.]com — to receive instructions from the attackers.
Recreates hidden PHP backdoors during page visits, so the infection can regenerate itself even if you clean up once.
Creates unauthorized administrator accounts, giving attackers a permanent, legitimate-looking way back in.
Plants a fake WordPress core file designed to blend in with the legitimate installation.
Drops PHP-executable .cache files that can run attacker code on the server.
Leaves a system cron marker to keep malicious tasks running on a schedule.
Steals credentials — WordPress logins, database passwords, and API keys — which means the damage can extend well beyond the single site.

Rank Math released version 3.0.124 as the clean replacement. But here is the critical point the advisory stresses: simply updating to 3.0.124 does not remove the traces of the malware. The update replaces the plugin’s files, but backdoors, rogue admin accounts, and stolen credentials survive an update untouched. If your site ran the tainted copy while it was active, an update alone is not remediation — full recovery is required.

Dark infographic showing the Rank Math supply-chain compromise flow from download server to website — The supply-chain attack path: a tainted update travels from the distribution server to your site through a channel you trust.

Attack Timeline: The 11-Hour Tainted Window

The single most important fact in this incident is the tainted window. Not every copy of 3.0.123 is malicious — only the copies distributed during a specific stretch were tainted:

Window opens: October 15, 2026 at 20:02 UTC
Window closes: October 16, 2026 at 07:12 UTC
Duration: approximately 11 hours

That means only sites that downloaded or updated to Rank Math SEO PRO 3.0.123 between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026 are affected. Copies obtained before the window opened or after it closed are clean. Following the discovery, Rank Math disclosed the incident and shipped the clean replacement, version 3.0.124.

Convert the window to your own timezone before you check anything. For example, in Pakistan Standard Time (UTC+5), the window runs from October 16, 01:02 PKT to October 16, 12:12 PKT. In US Eastern Time (UTC−4 during daylight saving), that is October 15, 4:02 PM EDT to October 16, 3:12 AM EDT. Your hosting control panel or update logs will record times in the server’s timezone — line them up against the UTC window, because an hour’s mistake here changes the verdict.

Security firm Wordfence has explicitly confirmed the point that trips up many site owners: merely having version 3.0.123 installed does not prove your site is compromised. Only the downloads from inside the tainted window matter. If your 3.0.123 came from outside the window, it is a clean copy of the same version number.

Who Is Affected? Three Scenarios

Whether you need to panic, take moderate action, or do nothing at all depends on exactly what happened on your site. There are three scenarios:

Scenario	What happened	Verdict	What to do
1. Installed + activated inside the window	You downloaded or updated to 3.0.123 between Oct 15 20:02 UTC and Oct 16 07:12 UTC, and the plugin was active on your site.	Compromised — treat the site as fully compromised.	Full recovery: restore a backup from before the window, or perform manual cleanup and rotate every credential (details below).
2. Installed but never activated	The tainted files reached your server, but the plugin was never activated, so the malicious code never executed.	Not compromised, but tainted files are present.	Delete the plugin files completely, install the clean 3.0.124, and run a full security scan to confirm.
3. Downloaded only	You grabbed the update package but never installed it on the site.	No indication of compromise.	Delete the downloaded archive and update to 3.0.124 through the normal channel.

Notice how narrow the danger zone is: the malware needs the plugin to be activated to execute. An inactive copy is inert — dangerous files sitting on disk, but not a running infection. That is why Scenario 2 calls for deletion and a scan rather than a full rebuild.

How to Check YOUR Site: 7 Steps

Work through these steps in order. Each one narrows the question down, and by Step 7 you will have a definitive answer.

Magnifying glass inspecting WordPress plugin files with malware warning highlights — Step-by-step verification beats panic: check version, timing, database, users, files, and network traces.

Step 1: Confirm your exact Rank Math SEO PRO version

In your WordPress dashboard, go to Plugins → Installed Plugins and find Rank Math SEO PRO. Note the exact version number. If you see 3.0.122 or earlier, the tainted build was never on your site through the normal update path — but continue with the timing check anyway, because version numbers alone do not tell you when an update happened. If you see 3.0.123, you need Step 2 urgently. If you are already on 3.0.124, determine when you updated: if the 3.0.123→3.0.124 jump happened after the window, a tainted 3.0.123 may have been active in between.

Step 2: Pin down WHEN the update happened

This is the decisive step. Check your update history against the tainted window (Oct 15, 20:02 UTC → Oct 16, 07:12 UTC):

Look at your hosting panel’s file timestamps for the plugin directory (wp-content/plugins/seo-by-rank-math-pro/ or your equivalent).
Check any activity-log or update-log plugin you run.
Ask your host for the access logs around that period if you have no local records.

If the 3.0.123 files landed on your server outside the window, your copy is clean — same version number, different build. If the timing is uncertain or the files date from inside the window, assume the worst and continue.

Step 3: Search your database for the malicious option keys

The malware stores data in the wp_options table under three known keys. Open phpMyAdmin (or your host’s database manager) and run:

SELECT * FROM wp_options WHERE option_name IN ('_uf6qdn2hmm', 't8krdk990phb', '_np5pvf754c');

(Adjust the table prefix if yours is not wp_.) If any rows come back, that is a confirmed infection sign. If the query returns nothing, that is one point in your favor — but keep going, because absence of one indicator is not proof of cleanliness.

Step 4: Audit your administrator accounts

Go to Users → All Users in wp-admin and look for accounts you did not create. The known rogue-account patterns in this incident are:

Usernames beginning with wpsupport_
Email addresses ending in @wp-mail.net

Check every account with the Administrator role — not just the obviously suspicious ones. Attackers sometimes grant admin rights to existing low-privilege accounts instead of creating new ones. If you find anything unfamiliar, do not just delete it yet: note the details first, because you will need them for the cleanup report — but revoke its admin privileges immediately.

Step 5: Hunt for the planted files

Two file-level indicators are documented for this malware:

wp-includes/class-wp-cache-util.php — this is not a legitimate WordPress core file. Its presence is a strong infection sign.
PHP-executable .cache files dropped in locations where they can run code.

Use your host’s file manager or SFTP to look, or better, run a file-integrity scan with a security plugin such as Wordfence or Sucuri, which flags unknown files in core directories automatically. Do not open suspicious PHP files in a way that executes them — view them as plain text only, or let the scanner handle them.

Step 6: Check for the cron marker and C2 traffic

The malware leaves a system cron marker containing #ms6v46 and phones home to rank1cdn.com. Two checks:

Review your server’s cron jobs (hosting panel → cron jobs, plus WordPress cron events via a plugin like WP Crontrol) for the marker.
Check outbound traffic logs or your security plugin’s firewall log for connections to rank1cdn.com.

Do not type the C2 domain into your browser to “check” it — analyze logs only. Visiting attacker infrastructure is never a diagnostic step.

Step 7: Run a full security scan and confirm

Finish with a comprehensive malware scan using a reputable scanner (Wordfence, Sucuri, or your host’s scanner). If Steps 1–6 are all clean and the scanner finds nothing, your site is in good shape — update to 3.0.124 if you have not already. If any step raised a flag, proceed to the recovery section below before doing anything else.

Infection Signs Checklist

Print this out or keep it open while you audit. If you can check every box as “not found,” you are clear:

Security checklist with checkmarks beside a shield while a website is scanned — The known indicators of the Rank Math 3.0.123 compromise — check every one.

☐ Database: wp_options contains _uf6qdn2hmm, t8krdk990phb, or _np5pvf754c
☐ Users: admin accounts with usernames starting wpsupport_
☐ Users: accounts with emails ending @wp-mail.net
☐ Files: wp-includes/class-wp-cache-util.php exists on the server
☐ Files: unexpected PHP-executable .cache files
☐ Network: outbound traffic to rank1cdn.com in logs
☐ Cron: cron marker #ms6v46 present
☐ Version/timing: 3.0.123 was downloaded or updated Oct 15 20:02 UTC → Oct 16 07:12 UTC and activated

One confirmed hit on any of these is enough to treat the site as compromised. Do not wait for multiple indicators — the malware is designed to hide, and a single trace means the attackers were inside.

What to Do Now: Affected vs. Not Affected

If you are affected (Scenario 1): full recovery

Take this seriously — a CVSS 9.8 supply-chain compromise with credential theft is not a “clean the plugin folder and move on” situation. The recommended recovery path:

Take the site offline or into maintenance mode to stop further data theft and prevent the malware from serving malicious content to visitors.
Restore a backup from before October 15, 2026 20:02 UTC — the start of the tainted window. This is the cleanest option and the one security professionals prefer.
If no pre-window backup exists, perform a manual cleanup: remove the tainted plugin, delete all identified backdoors and rogue files, remove unauthorized admin accounts, and clear the malicious cron entries — then have a professional verify the cleanup.
Rotate EVERY credential: all WordPress admin passwords, the database password (and update wp-config.php), hosting panel and FTP/SFTP credentials, and every API key stored on the site. The malware steals these, so anything it could have seen must be considered burned.
Re-scan everything after recovery and monitor outbound traffic for a period afterward.

If you are NOT affected: lock in your safety

Update to the clean 3.0.124 through the normal channel.
Enable automatic updates for security releases so a future tainted-window scenario is closed faster.
Verify that you have known-good backups from before October 15 — you will be glad they exist next time.
Keep a security scanner active with file-integrity monitoring turned on.

Affected vs. safe versions at a glance

Version	Status	Action required
3.0.122 and earlier	Safe — predates the tainted build	Update to 3.0.124 normally
3.0.123, obtained outside the tainted window	Safe — clean copy of the same version	Update to 3.0.124 normally
3.0.123, obtained inside the tainted window	Tainted — contains malware	Full recovery (backup restore or manual cleanup + credential rotation)
3.0.124	Safe — clean replacement release	None; this is the version to be on

A real-world check: our own sites

To put this in concrete terms: at DroidOrbit we audited our own properties against the timeline. Both DroidOrbit and our sister site TechVantageAPK run Rank Math SEO PRO 3.0.122 — the tainted 3.0.123 was never installed on either site, so both are unaffected by this incident. That is exactly the kind of version-and-timing verification described in Steps 1 and 2 above, and it is what every site owner should do right now.

Frequently Asked Questions

Does having Rank Math SEO PRO 3.0.123 installed mean my site is hacked?

No — not automatically. Only copies downloaded or updated during the tainted window (October 15, 2026 20:02 UTC to October 16, 2026 07:12 UTC) contain the malware. Wordfence has confirmed that the version number alone does not prove compromise. Check when your copy was obtained; if it was outside the window, it is a clean copy.

I updated during the tainted window but never activated the plugin. Am I safe?

You are not compromised, because the malicious code never executed — but the tainted files are sitting on your server. Delete the plugin files completely, install the clean 3.0.124, and run a full security scan to confirm nothing else is present.

Will updating to 3.0.124 remove the malware?

No. The 3.0.124 update replaces the plugin’s files with clean ones, but it does not remove backdoors the malware already planted, delete rogue admin accounts, or un-steal your credentials. An affected site needs full recovery: a pre-window backup restore or manual cleanup plus rotating every credential.

Is the free version of Rank Math affected?

The disclosed incident specifically concerns Rank Math SEO PRO 3.0.123. If you run only the free version of Rank Math, you are outside the disclosed tainted build. That said, the hygiene steps in this guide — checking admin users, scanning files, keeping backups — are good practice for every WordPress site regardless.

What is CVE-2026-111862 and how serious is it?

CVE-2026-111862 is the official identifier for this supply-chain compromise. It carries a CVSS score of 9.8 (Critical) — near the top of the severity scale — and is documented as exploited in the wild. In practical terms: it is as serious as software vulnerabilities get, because it combined a trusted distribution channel with full site-takeover capabilities and credential theft.

Conclusion

The Rank Math SEO PRO 3.0.123 incident is a textbook supply-chain attack: trusted software, an 11-hour tainted window, and malware capable of full site takeover. But it is also a narrowly scoped one — only downloads from October 15, 2026 20:02 UTC to October 16, 2026 07:12 UTC are affected, and the fix for everyone else is simply updating to the clean 3.0.124. Work through the 7 verification steps and the infection-signs checklist above, and you will know exactly where you stand. If you are in the affected group, do not cut corners: restore a pre-window backup or clean up manually, and rotate every credential the malware could have touched. In supply-chain incidents, thoroughness is the only shortcut.

Sources

Wordfence — Rank Math SEO PRO 3.0.123 malware analysis: wordfence.com/blog/2026/10/rank-math-seo-pro-3-0-123-malware/
Rank Math — PRO 3.0.123 security incident knowledge base: rankmath.com/kb/pro-3-0-123-security-incident/
SecurityOnline — Rank Math SEO PRO compromise exploited: securityonline.info/rank-math-seo-pro-compromise-exploited/

Rank Math Malware Alert: 7 Steps to Check Your Site’s Safety