Rank Math PRO Downloads Briefly Carried a Self-Rebuilding Backdoor in Supply-Chain Breach

For about 11 hours in mid-October, the vendor behind Rank Math PRO, a paid search-engine optimisation (SEO) plugin for WordPress, distributed a tampered version that installed hidden backdoors on websites. Rank Math disclosed the incident in a security notice on October 16. Wordfence followed with an advisory on October 17. The vendor says any site that installed and activated one of the affected copies should be considered compromised. Updating to the clean release does not undo the damage.

What happened

This was a supply-chain attack. Attackers did not break into individual websites. They tampered with software at its source, so customers received malware through a channel they trusted.

According to Rank Math, copies of Rank Math PRO downloaded from rankmath.com, or delivered as automatic updates, between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malicious code. BleepingComputer reports that the affected downloads were labelled version 3.0.123. It describes the number of affected users as limited, citing the vendor.

Rank Math says it removed the compromised files and published a clean build, version 3.0.124. It has emailed some customers and asked anyone unsure whether they installed or activated the bad files to contact its support team.

Wordfence pointed out an important limit of the fix. Installing 3.0.124 replaces the plugin's own files. It does not remove anything the malware may already have placed elsewhere on the server, such as extra files, administrator accounts or scheduled tasks.

While researching the attack, BleepingComputer found a PHP malware sample on VirusTotal, a public malware-scanning service. The file was named cache-preloader-fff033 (1).php and shared several indicators with Rank Math's advisory. Neither Rank Math nor Wordfence mentioned this file.

Who is affected

The incident concerns only Rank Math PRO, which customers download and update directly from rankmath.com rather than from the official WordPress.org plugin directory. The free Rank Math SEO plugin on WordPress.org lists more than 4 million active installations and was last updated on October 6. It is not named in the vendor's notice, and BleepingComputer reports that the vendor described it as unaffected.

The version number alone does not tell you whether a copy is bad. Rank Math's changelog dates version 3.0.123 to October 7, more than a week before the attack window opened. A copy of 3.0.123 obtained before 20:02 UTC on October 15 is outside the incident. Rank Math sorts sites into three cases:

• Installed and activated during the window: treat the site as compromised, even if it has since moved to 3.0.124.
• Installed but never activated: delete the plugin files, install 3.0.124 from your Rank Math account and run a security scan.
• Downloaded but never installed: nothing in this incident alone suggests the site was compromised.

The sources do not break down affected sites by sector or region, and the total number of compromised sites has not been disclosed.

How it works

Most of what is publicly known comes from Rank Math's notice. Neither the vendor nor Wordfence has published a full code analysis.

Once activated, the malware sets up persistence, meaning a foothold that survives normal cleanup attempts. It contacts a domain controlled by the attackers, rank1cdn[.]com. Its most troublesome feature is that it can rebuild its hidden backdoor whenever someone visits the site. A backdoor is a secret way in that lets attackers return at will. If an admin deletes the visible malicious files but leaves the rebuilding component in place, the backdoor can reappear on the next page load.

Rank Math lists a wide range of changes the attackers may have made:

• PHP backdoor files planted in other plugins' folders, in theme folders and in the "must-use" plugins directory, which WordPress loads automatically
• New administrator accounts
• A fake WordPress core file, wp-includes/class-wp-cache-util.php
• Edits to the .htaccess server configuration file so that files ending in .cache are executed as PHP code
• Scheduled tasks and added SSH keys, which allow remote server logins

The sample BleepingComputer found appears to work as a first-stage installer that creates the fake class-wp-cache-util.php file. It contained the _np5pvf754c database entry and code that creates administrator accounts with the wpsupport_ prefix and @wp-mail.net email addresses. Both indicators appear in Rank Math's alert. The script can also run commands, alter WordPress databases and steal cloud credentials for AWS, Cloudflare, Google Cloud and Azure, as well as SSH keys. BleepingComputer stresses that it could not confirm the sample was spread through the compromised plugin. The shared indicators only suggest the same threat actor is behind both.

How serious is it?

Very serious for affected sites. Wordfence assigned the incident CVE-2026-111862 and rated it 9.8 out of 10, with the researcher listed as unknown. These figures come from outlet reporting of Wordfence's advisory, as no separate verified CVE record was supplied.

Patchstack classifies the issue as a backdoor. It notes that because the attack happened on Rank Math's own systems, a firewall-style mitigation rule is not possible.

The malicious code was actually delivered to customers, so this is not a theoretical flaw waiting to be exploited. Rank Math warns that any password, database credential, API key or other secret the site could reach should be assumed exposed.

The outlets broadly agree on the facts. Their main difference is that BleepingComputer adds the VirusTotal sample and its credential-stealing features, which the vendor advisories do not cover.

What to do now

Rank Math's preferred fix is to restore from a backup made before 20:02 UTC on October 15. Without a clean backup, the order of cleanup steps matters.

• If you have a clean backup: restore both the site files and the database, run a security scan, change every password and credential, and only then install 3.0.124 from your Rank Math account.
• If you have no clean backup, do these three things first:
  • Delete the whole rank-math-pro folder using your host's file manager or FTP. "Deactivating the plugin alone is not sufficient," the notice warns.
  • In the wp_options database table, remove entries named _uf6qdn2hmm, t8krdk990phb or _np5pvf754c.
  • Block outgoing traffic to rank1cdn[.]com if your host or firewall allows it.
• Then hunt for leftovers:
  • Check PHP files in wp-content/mu-plugins/, other plugins, the inc/, includes/ and lib/ folders of non-default themes, Rank Math's own includes/ folder, and uploads/.
  • Look for heavily obfuscated PHP. Signs include base64_decode combined with XOR loops, the string xmmqhn, proc_open, or PHP-FPM socket code.
  • Delete the fake class-wp-cache-util.php file.
  • Remove admin accounts starting with wpsupport_ or using @wp-mail[.]net addresses.
  • Review .htaccess rules and .cache files, crontab entries tagged #ms6v46, WordPress scheduled events, SSH authorized_keys files, other users' crontabs, running processes, and any writable location outside the site.
• Rotate everything, even after a restore: WordPress passwords, the database credentials, security keys and salts in wp-config.php, payment gateway, SMTP and other API keys, hosting panel, FTP, SFTP and SSH logins, secrets stored in environment variables, and two-factor authentication settings.
• Everyday visitors cannot fix this themselves. If a site you use runs Rank Math PRO and its owner reports a compromise, consider changing any password you use there.

Wordfence cautions that not finding these indicators does not by itself prove a site is clean.

What we still don't know

• How the attackers got into Rank Math's distribution systems. BleepingComputer asked and had received no reply at publication.
• How many sites received or activated the tainted build.
• Who is responsible. No source names an attacker.
• Whether the VirusTotal sample was actually delivered through the plugin.
• Whether stolen credentials have already been misused.

ITVedas analysis: This incident shows that paid plugins updated outside WordPress.org depend entirely on the vendor's own infrastructure, so one breach can reach every customer at once. The self-rebuilding backdoor means a simple update is not enough, and admins whose sites were exposed should plan for a full cleanup and credential reset.