Rank Math PRO Supply-Chain Malware: CVE-2026-111862 Cleanup and Credential Rotation Guide

What happened​

Hackers injected malware into Rank Math PRO version 3.0.123 packages distributed between October 15 and October 16. Rank Math says the affected downloads and updates happened between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. That is about 11 hours.

The vendor describes the impact as limited to "a limited number of users." Neither Rank Math nor Wordfence has published a count of downloads, compromised sites or confirmed intrusions. BleepingComputer asked Rank Math about the number of affected sites and the initial attack vector, and had received no reply when it published. How the attacker got access is not established in the sources I reviewed.

Rank Math removed the affected files and released PRO 3.0.124 as the clean version. Wordfence Intelligence rates the compromise 9.8 (Critical) on the CVSS scale and lists 3.0.124 as the clean release. The CVE identifier is CVE-2026-111862. That CVE and score come from Wordfence, not from the plugin vendor.

Who is and isn't affected​

• PRO users only. Rank Math says the free Rank Math SEO plugin from WordPress.org is not affected and needs no action. The free plugin runs on more than 4 million sites. That number does not describe the exposed PRO population.
• The version number alone proves nothing. Wordfence stresses that 3.0.123 by itself doesn't show a compromise. What matters is when your copy was downloaded or updated.
• Auto-updates count. A site that pulled the update in the window could be affected without anyone clicking "download."
• Installed and activated in the window: treat the site as compromised.
• Installed but never activated: delete the plugin files, install clean 3.0.124 from your Rank Math account, and run a security scan.
• Downloaded but never installed or activated: Rank Math says this incident alone gives no indication of compromise. If you're unsure, contact Rank Math support.

Rank Math also says it holds records of who downloaded an affected copy. If you got an email from the vendor, Wordfence advises following the recovery instructions even if your site now runs a different version.

What the malware does​

According to Rank Math, the malware:

• establishes persistent access;
• communicates with rank1cdn[.]com;
• recreates a hidden backdoor whenever someone visits the infected site;
• puts at risk WordPress and database credentials, API keys and other secrets the web server can read.

Updating to 3.0.124 swaps out the Rank Math package. It does not remove files, administrator accounts or scheduled tasks the malware may already have created elsewhere. That is why the vendor says deactivating or updating after a compromise won't remove the threat.

The unconfirmed sample​

BleepingComputer found a PHP sample on VirusTotal named cache-preloader-fff033 (1).php. It shares several indicators with Rank Math's alert:

• the xmmqhn XOR key;
• the _np5pvf754c database entry;
• the #ms6v46 cron marker;
• admin-creation code using the wpsupport_ prefix and @wp-mail.net addresses.

BleepingComputer says the script looks like a first-stage dropper for the wp-includes/class-wp-cache-util.php backdoor. It also reports that the script can run commands, modify WordPress databases, and look for AWS, Cloudflare, Google Cloud and Azure credentials and SSH keys.

Be careful with this part. Neither Rank Math nor Wordfence mentioned the sample. BleepingComputer could not confirm it was distributed through the compromised plugin. Don't assume the cloud-credential theft capabilities describe what happened on a given Rank Math site. The sample is still a good reason to rotate cloud keys that were reachable from an exposed server.

Recovery: the vendor's order of operations​

1. Check whether you're in scope​

In the WordPress admin, go to Plugins and check your Rank Math PRO version. Then work out when that copy arrived. Look at update history, any site-management dashboard, or vendor emails.

2. Preferred path: restore from a clean backup​

If you have a backup from before October 15, 20:02 UTC, Rank Math calls this the recommended route. For reference, that is 16:02 EDT.

1. Restore both the site files and the database.
2. Run a security scan with a reputable tool. Rank Math names Wordfence and Sucuri as examples.
3. Rotate all credentials.
4. Install PRO 3.0.124 only after the restore.

If you don't know how to restore, ask your hosting provider.

3. No clean backup: manual cleanup, in order​

Rank Math warns that the backdoor can rebuild itself on visits. Removing files before disabling the rebuild mechanism may not fix anything.

First, stop the rebuild. Finish all three before moving on:

• Delete the entire rank-math-pro folder. Deactivating the plugin is not enough.
• In the wp_options table, delete any entry whose option_name is _uf6qdn2hmm, t8krdk990phb or _np5pvf754c.
• If your host or firewall supports it, block outbound connections to rank1cdn.com.

Then hunt for what's left:

• Hidden PHP backdoors. Check wp-content/mu-plugins/, other plugins' folders, the inc/, includes/ and lib/ folders of non-default themes, and the Rank Math includes/ folder. Look for base64_decode combined with XOR loops, the key xmmqhn, proc_open, or PHP-FPM socket code.
• Rogue administrators. Look for usernames beginning wpsupport_ or addresses ending @wp-mail[.]net. WP-CLI can list admins with wp user list --role=administrator.
• Fake core file. wp-includes/class-wp-cache-util.php is not a legitimate WordPress core file. If it's there, remove it and run wp core verify-checksums. Rank Math also advises reinstalling core from an official source.
• .htaccess and .cache files. Look for rules that let .cache files run as PHP, and search for .cache files containing PHP.
• Scheduled tasks. Review the web-server user's system crontab for the #ms6v46 marker. Use wp cron event list for WordPress events.
• Other code. Reinstall plugins and themes from official sources. Check uploads/ for PHP files, which normally shouldn't be there.
• The wider server. Look at SSH authorized_keys, other users' crontabs, running processes, and any location outside the site directory that the web-server user can write to. On shared hosting you may not be able to reach these, so ask your host.

4. Rotate everything, even after a restore​

Rank Math lists these:

• WordPress passwords;
• the database username and password in wp-config.php;
• WordPress security keys and salts;
• payment gateway keys, SMTP credentials and other API keys;
• hosting panel, FTP/SFTP and SSH credentials;
• secrets held in environment variables;
• administrator two-factor settings.

Then update your site configuration and connected services with the new values.

5. Verify​

• Run a full security scan.
• Run wp core verify-checksums.
• Run wp plugin verify-checksums --all. Rank Math notes that checksums may not exist for premium plugins, so compare against a clean copy from the developer.
• Monitor outbound connections for the following days and check whether removed files come back. If they do, the cleanup is incomplete.

Wordfence adds a caution: finding none of these indicators does not prove a site is clean.

Getting 3.0.124 safely​

Go directly to rankmath.com, sign in, and download from your account. Some users may need to reset their account password. Rank Math says it never sends login or download links by email. Treat any email with a reset or download link as suspicious. An incident like this is a good moment for phishing, so that advice is worth following.

Why this matters beyond WordPress​

• Trust in the update channel is the weak point. The malicious package reportedly replaced a legitimate release under the same version number. That is why the timestamp matters more than the version string. Some secondary write-ups say the genuine 3.0.123 shipped on October 7. I could not confirm that from the vendor's own notice, so treat it as unverified.
• Premium plugins often lack public checksums. That makes independent verification harder.
• Credential sprawl raises the cost. A web server that can read cloud keys, SMTP credentials and payment keys turns a plugin compromise into a wider incident. Admins should think about least privilege: keep long-lived cloud secrets out of web-readable files and environment variables.
• Staged updates help. Delaying auto-updates for business-critical sites, even by a day, would have avoided an 11-hour window like this one. That is general industry guidance, not something the vendors said about this case.

Bottom line​

If you run Rank Math PRO, check when your 3.0.123 copy arrived. If it landed in the October 15–16 window and was activated, restore from a pre-incident backup if you can. Otherwise follow the manual order exactly, and rotate every secret the site could read. If the plugin was never activated, delete it and install 3.0.124. The free Rank Math SEO plugin is not involved.