Cybersecurity
Rank Math PRO updates deliver backdoor
Rank Math said copies of its paid WordPress plugin were downloaded or updated in a narrow window, and security firms warned that reinstalling the clean release did not by itself clear all malicious changes.
- Rank Math said copies of Rank Math PRO downloaded from rankmath.com or delivered as updates between 20:02 UTC on 15 October and 07:12 UTC on 16 October contained malware.
- The company said any site that installed and activated one of those copies should be treated as compromised, and that the malware could recreate a hidden backdoor.
- Wordfence said that installing version 3.0.124 replaced the plugin but did not remove malicious files, administrator accounts or scheduled tasks already placed on the server.
- Rank Math said it had emailed some users and had not explained how the malicious files entered its system, how many customers received them or whether automatic updates delivered them.
- Wordfence assigned CVE-2026-111862, and Patchstack classified the incident as a backdoor and said a mitigation rule was not possible.
Rank Math said copies of Rank Math PRO obtained from rankmath.com, or pushed as updates between 20:02 UTC on 15 October and 07:12 UTC on 16 October, contained malware. The company said any site that installed and activated one of those copies should be regarded as compromised.
The notice said the malware could recreate a hidden backdoor when a visitor loaded the site. Wordfence said that installing version 3.0.124 replaced the plugin, but did not remove other malicious files, administrator accounts or scheduled tasks that may already have been added.
Rank Math said users should first determine whether they installed and activated the plugin during the window. If a clean backup from before 20:02 UTC on 15 October exists, it recommended restoring that copy, scanning the site, changing credentials and then installing 3.0.124 from a Rank Math account.
Without a clean backup, the company gave a fixed cleanup order that began with deleting the whole plugin folder, removing certain database entries and blocking outbound traffic to rank1cdn[.]com where possible. It also said the free Rank Math SEO plugin on WordPress.org was not named in the notice.
Rank Math and Wordfence said they had not analysed the code, and the article said neither had named who was behind the incident. Rank Math also did not say how the tainted files entered its system, how many customers received them or whether automatic updates were involved.
Named in this story
Companies
- Rank Math
- said affected copies of its PRO plugin were distributed through its own site and issued recovery guidance
- Wordfence
- said reinstalling the clean release did not remove all malicious changes and assigned a CVE
- Patchstack
- classified the incident as a backdoor and said a mitigation rule was not possible
- group.one
- the Swedish hosting group that owns Rank Math
Organisations
- WordPress.org
- hosts the free Rank Math SEO plugin and publishes checksums for it
Products and systems
- Rank Math PRO
- the paid WordPress plugin that was affected
How the source tells it
The source read as a plain security advisory with a cautious, procedural register and no distinct emotive framing.
No emotive framing was found in the original.