WordPress SEO plugin Rank Math compromised to backdoor websites

Section paragraphs are still long enough to push the article past 1,000 words. I’m compressing repeated lines while keeping every fact from the source.Some downloads of Rank Math PRO from the vendor’s official website carried malware that planted hidden backdoors in a supply-chain attack last week. A limited number of users who downloaded version 3.0.123 between October 15 at 20:02 UTC and October 16 at 07:12 UTC received files that could compromise a site upon activation. BleepingComputer's report by Bill Toulas, published October 19, 2026, at 05:24 PM, quotes Rank Math: “The affected plugin files contained malware that could compromise your website if the plugin was activated.”

This piece is for administrators who downloaded the paid plugin in that 11-hour window. It sets out the versions, the malicious domain, the file and database markers, and the cleanup order, with and without a clean backup. The vendor says the free Rank Math SEO edition on WordPress.org stayed unaffected, so that edition is not part of the bad download.

WordPress SEO plugin Rank Math compromised: what actually changed

Rank Math PRO version 3.0.123 is the package tied to the bad downloads from the official website. A limited number of users who downloaded it between October 15 at 20:02 UTC and October 16 at 07:12 UTC received compromised files. Malware in those files could compromise a website if the plugin was activated. Rank Math removed the affected files and released clean Rank Math PRO v3.0.124. Those timestamps mark the 11-hour window. The trojanized build was served from the vendor’s own website in this supply-chain attack.

Anyone who installed and activated the trojanized version in that window should treat their websites as compromised and follow the clean-up procedures in the vendor advisory. Rank Math PRO is the paid WordPress search engine optimization plugin that helps websites improve visibility in search results. The free variant is active on more than 4 million websites. Only the PRO version was compromised. The free Rank Math SEO package from WordPress.org remained unaffected, so those copies sit outside the vendor warning.

WordPress SEO plugin Rank Math compromised: how it works

Rank Math says the malware establishes persistent access, communicates with rank1cdn[.]com, and recreates hidden backdoors when someone visits the infected website. Users who install the compromised version of Rank Math PRO expose database credentials, API keys, and other secrets accessible to the web server. Rank Math warned in its advisory that the affected plugin files could compromise the website if the plugin was activated. The advisory names the backdoor file wp-includes/class-wp-cache-util.php. Deactivating or updating the plugin after a compromise will not remove the threat.

BleepingComputer found VirusTotal sample cache-preloader-fff033 (1).php, which appears connected to the compromise, though the Rank Math and Wordfence advisories do not mention it. The file contains the xmmqhn' XOR obfuscation key, the _np5pvf754c database entry, the #ms6v46 cron job marker, and code creating administrator accounts with the wpsupport_ prefix and @wp-mail.net addresses. This first-stage script creates the advisory backdoor wp-includes/class-wp-cache-util.php. It can execute commands, modify WordPress databases, and steal AWS, Cloudflare, Google Cloud, and Azure credentials, SSH keys, and other sensitive information. Indicators match the same threat actor, but distribution through the compromised plugin was not confirmed.

WordPress SEO plugin Rank Math compromised: why it matters now

The bad files were downloads of Rank Math PRO from the official website between October 15 at 20:02 UTC and October 16 at 07:12 UTC. Rank Math said, “We immediately removed the affected files and released a clean version, Rank Math PRO v3.0.124.” Rank Math says deactivating or updating the plugin after a compromise will not remove the threat. Persistent access, contact with rank1cdn[.]com, and hidden backdoors recreated when someone visits the site are the behaviors the vendor describes after activation.

Activated installs expose database credentials, API keys, and other secrets the web server can read. The VirusTotal sample cache-preloader-fff033 (1).php can execute commands, modify WordPress databases, and steal AWS, Cloudflare, Google Cloud, and Azure credentials, plus SSH keys and other sensitive information. BleepingComputer could not confirm that file was distributed through the compromised plugin. The script creates wp-includes/class-wp-cache-util.php. As of publication on October 19, 2026, Rank Math had not replied with the number of potentially affected sites or the initial attack vector.

WordPress SEO plugin Rank Math compromised: who is affected

A limited number of users who downloaded Rank Math PRO 3.0.123 from the official website between October 15 at 20:02 UTC and October 16 at 07:12 UTC received compromised files. Websites where that trojanized version was installed and activated should be treated as compromised. Only the PRO version was compromised. Free Rank Math SEO from WordPress.org remained unaffected. The free variant is active on more than 4 million websites. That figure is the free plugin’s install base, and no count of compromised PRO sites was published.

BleepingComputer asked Rank Math for the number of potentially affected sites and the initial attack vector, and had no response by 05:24 PM on October 19, 2026. Users who installed the compromised plugin but never activated it should delete it, download the clean 3.0.124 version, and then scan their sites. Users who activated 3.0.123 in the 11-hour window need the full clean-up, because deactivating or updating will not remove the threat. The Wordfence advisory also did not name cache-preloader-fff033 (1).php.

WordPress SEO plugin Rank Math compromised: what to watch

Administrators who suspect a compromise should restore website files and the database from a clean backup, run security scans, and rotate all passwords, keys, and salts. With no safe backup, Rank Math recommends manual cleanup: delete the entire plugin folder and malicious database entries, then check for additional backdoors, unauthorized administrator accounts, altered files, scheduled tasks, and changes outside WordPress. Deactivating or updating will not remove the threat. Block all outbound connections to the attacker’s rank1cdn[.]com domain. The named backdoor is wp-includes/class-wp-cache-util.php.

Search for the xmmqhn' XOR obfuscation key, the _np5pvf754c database entry, the #ms6v46 cron job marker, and administrator accounts using the wpsupport_ prefix with @wp-mail.net email addresses. Those indicators are in Rank Math’s alert and in cache-preloader-fff033 (1).php on VirusTotal, a file neither advisory named. Distribution of that sample through the plugin was not confirmed. Never-activated installs should be deleted, replaced with clean Rank Math PRO 3.0.124, and scanned. Activated 3.0.123 from the October 15–16 window should be treated as compromised and cleaned from a backup or by hand.