Full Report
Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a security notice published on October 16. Any site that installed and activated one of those copies should be treated as compromised, and the
Analysis Summary
# Incident Report: Rank Math PRO 3.0.123 Supply-Chain Compromise Delivers Self-Restoring Backdoor
## Executive Summary
Copies of Rank Math PRO 3.0.123, the paid version of the Rank Math SEO WordPress plugin, downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026, contained malware. Any site that installed and activated one of these copies should be treated as compromised, since the malware can recreate its hidden backdoor whenever the site is visited. Rank Math removed the affected files and released clean version 3.0.124, but updating alone does not remove the backdoor's other footholds.
## Incident Details
- **Discovery Date:** Rank Math published its security notice on October 16, 2026. Wordfence published an advisory on October 17, 2026. The article is dated October 19, 2026. The exact date of internal detection by Rank Math is not stated.
- **Incident Date:** Malicious copies were available from 20:02 UTC, October 15, 2026, to 07:12 UTC, October 16, 2026.
- **Affected Organization:** Rank Math (vendor, source of the malicious distribution). The customer sites affected are not individually identified. The article does not name any affected customer.
- **Sector:** Web software / WordPress plugin ecosystem (customers include any organization or individual running WordPress sites with the PRO plugin).
- **Geography:** Not specified. Impact is described as global to the extent the PRO plugin was used, but no regional data is given.
## Timeline of Events
### Initial Access
- **Date/Time:** Malicious PRO copies became available at 20:02 UTC, October 15, 2026. The window closed at 07:12 UTC, October 16, 2026.
- **Vector:** Supply-chain compromise. The malware was distributed through the official Rank Math PRO download channel (rankmath.com) and through the plugin's update delivery, not through WordPress.org.
- **Details:** Customers who downloaded or installed-by-update 3.0.123 during the window and activated it are considered compromised. A copy of 3.0.123 obtained before the window is outside the incident. The version number alone does not identify affected copies. Per the notice, only the PRO plugin is affected. The free version on WordPress.org is not named.
### Lateral Movement
- The article does not describe lateral movement between hosts or networks. Based on the disclosed behavior, the malware spreads within the compromised WordPress installation by placing PHP backdoors in other plugin folders, theme folders, and the must-use plugins directory. It also changes .htaccess so that .cache files execute as PHP, and it may add SSH keys and scheduled tasks on the server.
### Data Exfiltration/Impact
- **Confirmed/Reported:**
- Persistent backdoor that recreates itself on site visits
- Possible unauthorized administrator accounts
- A fake WordPress core file
- Scheduled tasks and SSH keys on the server
- Outbound connections to rank1cdn[.]com
- **Potential:** Any password, database credential, API key, or other secret the site could reach should be assumed exposed. The article does not confirm specific data theft.
### Detection & Response
- **Detection:** Rank Math identified the malicious copies and published a security notice on October 16, 2026. Wordfence analyzed the incident and published an advisory on October 17, 2026. Patchstack published a database entry classifying the issue as a backdoor.
- **Response actions taken:**
- Rank Math removed the affected files and released clean version 3.0.124.
- Rank Math emailed some users and asked anyone unsure whether they had installed or activated the files to contact support.
- Wordfence assigned CVE-2026-111862 (CVSS 9.8, researcher listed as unknown).
- Rank Math published recovery guidance, including a preferred restore from a pre-incident backup and a manual cleanup procedure.
## Attack Methodology
- **Initial Access:** Compromised vendor distribution. Malicious code was included in PRO 3.0.123 copies served from rankmath.com and via updates.
- **Persistence:** The malware recreates its hidden backdoor whenever the site is visited. It also leaves PHP backdoors in plugin, theme, and mu-plugins directories, a modified .htaccess that executes .cache files as PHP, scheduled tasks, and SSH keys.
- **Privilege Escalation:** Not described in the article. The creation of administrator accounts suggests the attacker obtained or created administrative access.
- **Defense Evasion:** The malware uses base64_decode with XOR loops (key xmmqhn) to obfuscate code. It also hides its backdoor and uses obscure wp_options entries and a fake core file. Deleting suspicious files before stopping the recreation mechanism may not remove the threat.
- **Credential Access:** Not detailed. Owners should assume any reachable password, database credential, or API key was exposed.
- **Discovery:** Not described. The malware appears to check or use wp_options entries and PHP-FPM socket code.
- **Lateral Movement:** Within the WordPress installation and server, via backdoors in other extensions, theme folders, the mu-plugins directory, and scheduled tasks and SSH keys.
- **Collection:** Not described in the article.
- **Exfiltration:** Outbound connections to rank1cdn[.]com are indicated. Specific data theft methods are not described.
- **Impact:** Persistent unauthorized control of the WordPress site and possibly the server, with the potential for further compromise of connected systems.
## Impact Assessment
- **Financial:** Not disclosed.
- **Data Breach:** Potential exposure of any secrets reachable by the site, including passwords, database credentials, and API keys. Actual data theft is not confirmed in the article.
- **Operational:** Affected sites must be restored or thoroughly cleaned, with password and credential rotation. The clean-up order is critical, and a simple plugin update does not complete remediation.
- **Reputational:** Damage to trust in Rank Math's official distribution channel. The incident affects a plugin with a large user base (the free version alone exceeds 4 million active installations, though the PRO affected population is not stated).
## Indicators of Compromise
**Network Indicators:**
- Outbound domain: rank1cdn[.]com (block if possible)
**File Indicators:**
- Affected version: Rank Math PRO 3.0.123 (malicious copies delivered 20:02 UTC Oct 15 to 07:12 UTC Oct 16, 2026)
- Clean version: 3.0.124
- PHP backdoor files in: wp-content/mu-plugins/, other plugin folders, inc/, includes/, and lib/ folders of non-default themes, Rank Math's includes/ folder, and uploads/
- Fake WordPress core file
- .htaccess modified to execute .cache files as PHP
- Unauthorized SSH keys and scheduled tasks
- CVE: CVE-2026-111862
**Code Indicators:**
- PHP using base64_decode with XOR loops
- XOR key: xmmqhn
- Use of proc_open
- PHP-FPM socket code
**Database Indicators (wp_options option_name values):**
- _uf6qdn2hmm
- t8krdk990phb
- _np5pvf754c
**Behavioral Indicators:**
- Backdoor recreates itself on site visits
- Unexpected administrator accounts
- Outbound connections to rank1cdn[.]com
## Response Actions
**Containment:**
- Treat sites that installed and activated 3.0.123 during the window as compromised.
- Block outgoing connections to rank1cdn[.]com if the hosting provider or firewall allows it.
- Delete the entire rank-math-pro plugin folder via hosting file manager or FTP. Deactivation alone is insufficient.
**Eradication:**
- Delete the wp_options entries listed above.
- Search for and remove PHP backdoors in the locations listed above.
- Review administrator accounts, scheduled tasks, SSH keys, and .htaccess for unauthorized changes.
- Remove the fake core file and verify core files against clean copies.
**Recovery:**
- Preferred: restore from a clean backup taken before 20:02 UTC on October 15, 2026 (site and database), run a security scan, change every password and credential, then install 3.0.124 from the Rank Math account.
- If no clean backup exists: complete the manual cleanup, rotate all secrets (passwords, database credentials, API keys), run a full security scan, then install 3.0.124.
## Lessons Learned
- **Key takeaways:**
- Vendor distribution channels can be compromised, so even paid, official software can deliver malware.
- A version number does not reliably indicate whether a copy is malicious. The timing of download or update matters.
- Updating to a clean version does not remove persistence mechanisms left behind by the malware.
- Deactivating a plugin is not sufficient. The files must be deleted.
- Perimeter controls such as WAF rules may not help when the malicious code arrives through a trusted vendor.
- **What could have been done better:**
- Vendors could validate build and release pipelines, sign packages, and publish checksums so customers can verify integrity.
- Customers could have maintained recent, verified backups to enable clean restoration.
- Automated monitoring for new administrator accounts, file changes, and unexpected outbound connections could have detected the compromise sooner.
- Customers without a clear cleanup procedure may have deleted files before stopping the recreation mechanism, which could have caused reinfection.
*Note: The source article is truncated. The end of the recovery procedure, including the remaining search steps and the file-level details, is not included here.*
## Recommendations
- **Vendors:** Implement signed releases, checksum verification, hardened build and distribution infrastructure, and audit logging of release pipelines. Notify customers promptly and provide clear remediation guidance.
- **Site owners:**
- Maintain tested, offline or immutable backups of sites and databases taken regularly.
- Verify whether PRO 3.0.123 was installed or activated during the window, and follow the appropriate recovery path.
- Follow the manual cleanup order: delete the plugin folder, remove the listed wp_options entries, and block outbound connections to the known domain before further cleanup.
- Rotate all passwords, database credentials, API keys, and SSH keys after cleanup.
- Monitor for new administrator accounts, unauthorized file changes, modified .htaccess, and unexpected scheduled tasks.
- Restrict file-writing permissions and disable PHP execution in upload and cache directories where feasible.
- Restrict outbound traffic from web servers to known-good destinations.
- Subscribe to vendor security notices and verify plugin versions and checksums after updates.
- **Organizations:** Include third-party WordPress plugins in supply-chain risk assessments, and maintain an inventory of paid plugins and their update sources.