Critical Rank Math PRO Plugin Flaw Lets Attackers Install Backdoors

Key Takeaways

• Malicious code was embedded in specific packages of the Rank Math PRO WordPress plugin, affecting versions distributed between October 15 and October 16, 2026.
• This supply chain compromise allowed attackers to install self-healing backdoors on websites, which could regenerate even after manual removal attempts.
• The free Rank Math SEO plugin (available on WordPress.org) was not impacted by this incident.
• A clean version (3.0.124) has been released, but simply updating the plugin is insufficient for full recovery; extensive manual cleanup or a full site restore from a clean backup is necessary.
• Compromised sites require thorough investigation, credential rotation, and security scans to ensure complete eradication of the threat.

Malicious Code Found in Rank Math PRO Plugin Distribution

A critical security incident has emerged involving the Rank Math PRO WordPress plugin, where malicious code was discovered within specific versions distributed during a limited timeframe in October 2026. This compromise allowed for the installation of persistent backdoors on affected websites, posing a significant threat to their integrity and security.

Rank Math confirmed that certain packages of version 3.0.123, downloaded between October 15, 2026, at 20:02 UTC and October 16, 2026, at 07:12 UTC, contained malicious payloads. Once activated, these payloads could compromise a website, establishing hidden backdoors designed to regenerate themselves even after initial removal attempts. The vendor promptly addressed the issue by removing the compromised files and releasing a clean update, version 3.0.124.

While Rank Math described the incident’s impact as “limited,” specific figures regarding the number of affected websites were not disclosed in their security advisory. It is crucial to note that the free Rank Math SEO plugin, available through WordPress.org, was not affected by this supply chain attack, and its users do not need to take any action related to this incident.

Backdoor Persistence and Recovery Challenges

The malicious code introduced into Rank Math PRO 3.0.123 exhibits a particularly concerning characteristic: persistence. Rank Math warns that the malware is designed to recreate its hidden backdoor whenever an infected website is visited. This means that simply deleting a suspicious PHP file or deactivating the plugin will only offer temporary relief, as the underlying components responsible for its restoration may remain active.

Website owners who installed and activated an affected package must assume their sites are compromised. For those who installed but did not activate the package, the recommendation is to delete it, install the clean version, and perform a precautionary scan. Merely downloading the file without installation or activation does not constitute a compromise.

Effective recovery from this incident demands more than just a plugin update. It necessitates a comprehensive manual cleanup process or a full site restoration from a clean backup.

Detailed Cleanup and Mitigation Steps

Manual cleanup procedures should begin with the complete deletion of the rank-math-pro directory. Following this, administrators must remove malicious entries from the WordPress options table. Rank Math has identified three specific option_name values to look for: _uf6qdn2hmm, t8krdk990phb, and _np5pvf754c. Additionally, where supported, hosting providers or firewalls should block outgoing connections to rank1cdn[.]com to disrupt command-and-control communications.

The vendor also highlighted several common locations where hidden PHP files associated with the backdoor might reside. These include wp-content/mu-plugins/, other plugin folders, non-default theme directories, and Rank Math’s own includes/ folder. Investigators should search for code patterns such as base64_decode combined with XOR loops, the key xmmqhn, proc_open, or PHP-FPM socket code within these files, as these are strong indicators of malicious activity.

Further warning signs include the presence of unfamiliar administrator accounts with usernames starting with wpsupport_ or email addresses ending in @wp-mail[.]net. A fake core file, wp-includes/class-wp-cache-util.php, has also been identified. Cleanup efforts should also involve checking .htaccess rules that might permit .cache files to execute as PHP, and system cron entries tagged with #ms6v46, as these represent potential persistence mechanisms.

This incident underscores the challenges posed by self-healing malware, reminiscent of previous WordPress compromises where surviving components continuously restored deleted files, and highlights how trusted plugin features can be exploited for persistent access and account takeover.

What You Should Do

• Restore from Backup: The most secure recovery method is to restore both website files and the database from a clean backup created before October 15, 2026, at 20:02 UTC. Ensure the backup is truly clean, as restoring only plugin files may leave malicious database content untouched.
• Update Plugin: After restoration (or if a clean backup is unavailable), install Rank Math PRO 3.0.124 directly from your Rank Math account.
• Perform Manual Cleanup (If No Clean Backup): If a suitable backup is unavailable, disable the rebuilding mechanism and conduct a thorough manual investigation. This includes deleting the entire rank-math-pro directory, removing specific malicious entries from the WordPress options table (_uf6qdn2hmm, t8krdk990phb, _np5pvf754c), and searching for hidden PHP files in various directories (wp-content/mu-plugins/, other plugin folders, theme directories, rank-math-pro/includes/).
• Block Outgoing Connections: Configure firewalls or hosting providers to block outgoing connections to rank1cdn[.]com.
• Review and Rotate Credentials: Treat all secrets accessible to the compromised website as potentially exposed. Immediately replace WordPress passwords, database credentials, security keys and salts, payment gateway keys, SMTP credentials, API keys, and hosting access credentials. Review administrator two-factor authentication settings.
• Check for Malicious Accounts and Files: Look for unfamiliar administrator accounts (e.g., usernames starting with wpsupport_ or emails ending @wp-mail[.]net). Verify the authenticity of wp-includes/class-wp-cache-util.php. Review .htaccess rules and system cron entries (e.g., tagged #ms6v46).
• Scan Your Website: Run comprehensive security scans using reputable tools like Wordfence or Sucuri. Additionally, use wp core verify-checksums to check WordPress core file integrity. For premium plugins, compare files against official clean copies.
• Examine Server-Level Elements: Review SSH authorized_keys, running processes, other users’ crontabs, and writable locations outside the website directory. Shared hosting customers should request their provider to examine areas they cannot access.
• Monitor Activity: Continuously monitor outgoing connections and incoming files for several days post-cleanup to detect any lingering malicious activity.
• Download Safely: Always visit the Rank Math website directly for downloads and updates. Rank Math will not email login or download links.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.