Moatline

Rank Math PRO 3.0.123 malware: who is affected and how to clean up

For about 11 hours on 15 and 16 October 2026, the Rank Math PRO update contained a backdoor. If your site installed and activated that copy, treat the site as hacked. Here is how to tell, and what to do in which order.

By the Moatline team at Next Nova Technologies · Published 20 October 2026 · 5 min read

Updated Rank Math PRO on 15 or 16 October?See whether your site is already showing malware to visitors. Free, about 20 seconds.
Check my site free

Short answer

  • Affected: Rank Math PRO 3.0.123 downloaded 15 Oct 20:02 – 16 Oct 07:12 UTC. The free plugin is fine.
  • Do now: delete the whole Rank Math PRO plugin folder and install 3.0.124.
  • Then: remove what the backdoor left and change every password and key.

This was a supply-chain attack: the malware came inside a normal plugin update, so even well-kept sites were hit. Rank Math published an advisory on 16 October and updated it on 19 October.

What happened

  • What: Rank Math PRO version 3.0.123 contained a backdoor when it was downloaded or updated between 15 October 2026, 20:02 UTC and 16 October 2026, 07:12 UTC, about 11 hours.
  • Fixed in: 3.0.124, a clean release.
  • Not affected: the free Rank Math SEO plugin from WordPress.org, and copies of 3.0.123 from outside that window.
  • What the backdoor does: it lets the attacker run commands on your server, adds administrator accounts, hides copies of itself in other folders, and contacts rank1cdn.com for instructions.

Are you affected?

  • Installed and activated during the window: treat the site as compromised. Follow every step below.
  • Installed during the window but never activated: delete the Rank Math PRO plugin folder, install 3.0.124, then scan the site to be sure.
  • Downloaded the zip but never installed it: there is no sign of compromise. Delete the zip and download 3.0.124.
  • Not sure when it updated: check your hosting or WordPress activity logs for the update time. If you can’t find it, assume you are affected.

The version number alone is not proof: a 3.0.123 copy from after the window is clean.

Check your site

The free Moatline Malware Scanner (version 1.2.1 or later) checks for all of the signs below except the server crontab: install it, open Malware Scanner → Dashboard and click Scan now. To check by hand:

  1. The fake core file. Look for wp-includes/class-wp-cache-util.php. WordPress has no file with this name.
  2. Database options. In wp_options, look for _uf6qdn2hmm, t8krdk990phb and _np5pvf754c.
  3. Administrator accounts. Look for usernames starting with wpsupport_ and email addresses ending in @wp-mail.net.
  4. .htaccess and .cache files. Look for .htaccess rules that make .cache files run as PHP (lines with AddHandler, AddType or SetHandler and .cache), and for .cache files that contain <?php.
  5. Hidden copies. The backdoor hides in wp-content/mu-plugins/, in other plugins’ folders, in the inc/, includes/ and lib/ folders of themes you installed, and in Rank Math’s own includes/ folder. Search PHP files for rank1cdn and for the text xmmqhn, the key it uses to decode itself.
  6. Scheduled tasks. Ask your host to check the server crontab for entries tagged #ms6v46, and check WordPress cron jobs with wp cron event list.
  7. Core files. Run wp core verify-checksums and wp plugin verify-checksums --all, or reinstall WordPress from Dashboard → Updates.

Cleanup, in this order

  1. Back up first, even the infected site, so you have evidence and a way back.
  2. Delete the whole Rank Math PRO folder (seo-by-rank-math-pro or rank-math-pro in wp-content/plugins) over SFTP or your host’s file manager. Deactivating is not enough. Install 3.0.124 or later fresh.
  3. Delete the three options listed above from the database.
  4. Block outbound connections to rank1cdn.com if your host or firewall allows it, so any copy you miss can’t get new instructions.
  5. Hunt for what it left: the fake core file, wpsupport_ administrators, the .htaccess rules and .cache files, the hidden copies, PHP files in wp-content/uploads, and the crontab entries. On a server you control, also check ~/.ssh/authorized_keys, other users’ crontabs and running processes.
  6. Change every secret listed in the next section.
  7. Check again the next day and a few days later: scan, verify core and plugin checksums, and watch for connections to unknown hosts and files that come back.

Prefer a backup? Restoring files and database from before 15 October 2026, 20:02 UTC is the cleanest option. Then install 3.0.124 and change every secret below.

Secrets to change

The backdoor could read anything stored on the server, so assume these were copied:

  • Every WordPress password, starting with administrators. Review two-step login for each admin.
  • The database password (in wp-config.php and at your host), and new security keys and salts in wp-config.php, which signs everyone out.
  • Payment gateway, SMTP and other API keys saved in plugin settings.
  • Hosting control panel, FTP/SFTP and SSH passwords and keys.
  • Cloud keys stored on the server (AWS, Cloudflare, Google Cloud, Azure). BleepingComputer linked a related sample that steals these.

Indicators

For site owners, hosts and security teams. Sources: Rank Math’s advisory and BleepingComputer’s report.

  • Plugin: Rank Math PRO 3.0.123 downloaded 15 Oct 20:02 – 16 Oct 07:12 UTC.
  • File: wp-includes/class-wp-cache-util.php.
  • Options: _uf6qdn2hmm, t8krdk990phb, _np5pvf754c.
  • Domain: rank1cdn.com.
  • Code: base64 decoding with an XOR loop using the key xmmqhn; proc_open; PHP-FPM socket code.
  • Accounts: administrators named wpsupport_ plus random characters, emails @wp-mail.net.
  • Server: .htaccess rules running .cache files as PHP; crontab entries tagged #ms6v46.
  • Possibly related (not confirmed): a first-stage dropper named cache-preloader-fff033 (1).php that steals cloud credentials and SSH keys.

Sources: Rank Math’s security advisory and BleepingComputer’s report of 19 October 2026.

Other plugins are being attacked right now too. See the live list of WordPress plugins under active attack.

Don’t want to do this yourself? Our team cleans hacked WordPress sites every week: WordPress malware removal service, from $45, usually done within 24 hours.

Frequently asked questions

Is the free Rank Math SEO plugin affected?
No. Only the paid Rank Math PRO add-on was affected. The free Rank Math SEO plugin from WordPress.org was not changed.
My site shows Rank Math PRO 3.0.123. Is it infected?
Not necessarily. Only copies downloaded or updated between 15 October 20:02 and 16 October 07:12 UTC contain the backdoor. A site that installed 3.0.123 outside that window has a clean copy. If you can’t tell when it updated, treat it as affected: it costs little to check.
Is deactivating Rank Math PRO enough?
No. Delete the whole Rank Math PRO plugin folder and install 3.0.124 or later fresh. The backdoor also copies itself to other places, so the checks in this guide are still needed after the folder is gone.
Should I restore a backup instead?
If you have a backup of files and database from before 15 October 2026, 20:02 UTC, restoring it is the cleanest option. After restoring, install Rank Math PRO 3.0.124 and change every password and key listed in this guide, because the backdoor may already have copied them.

Scan your site for free

Moatline checks files, the database and page-builder content. Nothing changes unless you click a button.

Get it free on WordPress.org

More guides

All guides →