Some Rank Math PRO Downloads Carried a Backdoor

Rank Math PRO 3.0.123, downloaded from the vendor’s own website on October 15 and 16, carried malware that updating the plugin does not remove, BleepingComputer reported.

This one is for the Ecommerce Paradise reader who runs a WordPress blog, a WooCommerce shop or a quote funnel next to a Shopify store. If you pay for Rank Math PRO, you have a check to run today, because Rank Math says the malware can expose database credentials, API keys and other secrets the web server can read. If your whole business sits on Shopify and you never installed the plugin, forward this to whoever maintains your content site.

Below: what was compromised and when, why premium plugin channels keep getting hijacked, what a hit costs a store doing real revenue, and the cleanup in the order the vendor says to run it. If you are new here, start with my primer on high-ticket dropshipping and come back.

A compromised plugin is a business problem before it is an IT problem, so form your LLC with Northwest Registered Agent, the best LLC formation service for ecommerce owners. When a regulator, a plaintiff or a customer’s lawyer looks up your company, the address on the LLC filing is where they look first, and Northwest puts its own address there instead of yours. Form your LLC with Northwest →

Rank Math PRO 3.0.123 Backdoor: The 11-Hour Download Window

Rank Math said in a security notice dated October 16 that some downloads of its paid PRO plugin, version 3.0.123, contained malware. According to BleepingComputer’s Bill Toulas, copies downloaded between October 15 at 20:02 UTC and October 16 at 07:12 UTC were affected, a window of about 11 hours.

The company’s own words: “The affected plugin files contained malware that could compromise your website if the plugin was activated.” Rank Math said it removed the files and released a clean version, 3.0.124.

Per Rank Math, the malware establishes persistent access, talks to a server at rank1cdn[.]com and recreates its hidden backdoors whenever someone visits the infected site. Installing the compromised release can expose database credentials, API keys and other secrets the web server can reach. Deactivating or updating the plugin does not remove the threat, the company said.

The vendor sorts site owners into three cases. Installed and activated 3.0.123 during the window: treat the site as compromised. Installed it but never activated it: delete the files, install 3.0.124 from your account and scan. Downloaded it but never installed it: the notice says the incident alone is no sign of compromise.

Nobody has said how many sites were hit. Rank Math described a “limited number of users” and, per BleepingComputer, did not answer questions about the count or the initial attack vector before publication. The free Rank Math SEO plugin, active on more than 4 million sites through WordPress.org, was not affected.

Here is the part that breaks the usual playbook. The Hacker News reported that the version number alone does not tell you whether your copy is bad. Rank Math’s changelog dates 3.0.123 to October 7, so only copies obtained during the 11-hour window count.

The incident carries CVE-2026-111862 and a 9.8 out of 10 severity score, per The Hacker News. Patchstack, which published its entry on October 17, lists 3.0.123 as the affected version and 3.0.124 as the fix. It says no firewall rule can mitigate the problem because the attack hit Rank Math’s own infrastructure.

BleepingComputer also found a PHP file on VirusTotal that shares indicators with Rank Math’s alert. The file appears to be a first-stage script that creates the backdoor at wp-includes/class-wp-cache-util.php. It can run commands, edit the WordPress database and steal AWS, Cloudflare, Google Cloud and Azure credentials and SSH keys. BleepingComputer could not confirm that the file was distributed through the plugin.

The indicators to hunt for, per Rank Math and The Hacker News: administrator accounts whose usernames start with wpsupport_ or whose emails end in @wp-mail[.]net, that fake core file in wp-includes, three wp_options rows named _uf6qdn2hmm, t8krdk990phb and _np5pvf754c, and cron entries tagged #ms6v46. Wordfence cautions that finding none of these does not prove a site is clean.

German outlet Dr. Web reported that Rank Math tells affected customers to assume their site is compromised. The company never sends download links by email, so you get 3.0.124 only after logging in at rankmath.com.

Premium Plugin Updates Keep Delivering Backdoors in 2026

The Hacker News counts this as at least the third premium WordPress plugin vendor whose update channel delivered backdoored builds this year, after Nextend’s Smart Slider 3 Pro in April and ShapedPlugin in June. It states that no published evidence ties the incidents to the same attackers.

Dr. Web explains why premium plugins are the soft target. They update from the vendor’s own server instead of wordpress.org, and checksums are not available for every premium plugin. The outlet compares this case to a 2025 Gravity Forms backdoor.

The preparation was deliberate. The Hacker News reports that rank1cdn[.]com was registered on October 14 at 19:31 UTC, about a day before the window opened. How the attackers got into Rank Math’s systems is still unknown.

EP has covered this pattern from both platform sides. I wrote up the WordPress version when a Ninja Forms flaw planted hidden admins on stores. The Shopify version showed up when three Shopify apps were hijacked into fake checkouts.

The case that this is contained is real. Rank Math says a limited number of users were affected, the window lasted 11 hours and the free plugin was untouched. I found no report of confirmed victims or active mass exploitation in the sources above, though Patchstack says flaws of this type are expected to be exploited.

What a Rank Math PRO Compromise Costs a Store Owner

My read is that this is a credentials story more than a plugin story. The plugin is the door. What walks out is every secret the server can read, and a store’s server reads a lot: database logins, payment gateway keys, SMTP passwords and the API key that lets your email platform send as you.

If your whole business is a Shopify store with no WordPress install anywhere, you are not exposed to this one. The risk sits in the stack you forgot about: the content site your last freelancer built, the quote funnel on a subdomain, the old WooCommerce test shop that still has live keys. High-ticket stores have more of these than they admit, because long sales cycles push owners toward content sites and lead forms that capture contact details.

Run hypothetical numbers. Say a store books $1,500 a day in revenue and spends $300 a day on ads, and a cleanup takes the site down for three days. That is $4,500 in lost sales and $900 of ad spend pointed at a dead page if nobody pauses campaigns. Those figures are invented for illustration, not a reported loss, but the shape holds: the downtime costs more than the cleanup.

Three scenarios, each with a threshold. First, you have no PRO license or never touched 3.0.123. You are done once you confirm it in the Plugins screen. Second, you run PRO but your copy arrived before October 15 at 20:02 UTC or after October 16 at 07:12 UTC. By the vendor’s window you are outside the bad batch, and I would still rotate secrets if the timestamp sits within a day of either edge, because a timestamp is not a verdict.

Third, your copy landed inside the window and you activated it. Treat the site as compromised. If your newest clean backup predates October 15 at 20:02 UTC, take the loss of any content changes since and restore. Manual cleanup is the alternative, and Rank Math’s order of operations makes it slower and easier to get wrong.

Hosting choice earns its money in scenario three. A managed host with daily offsite backups and one-click restore turns a bad week into an afternoon. My shortlist for managed WordPress hosting starts with Cloudways. The more traditional option is SiteGround. Check the backup retention on whichever plan you pick before you need it, because a hypothetical seven-day retention means the last pre-window copy rolls off around October 22.

Version pinning would not have saved you, which is the uncomfortable part. The bad files shipped under a version number that had been public since October 7. What helps is file integrity monitoring and a restore point you trust, not a changelog check.

I would not swear off premium plugins. I would count them. Every paid plugin is a standing trust relationship with a vendor’s server, so each one should earn its keep. If you pay for Rank Math PRO for two features, price those two features against the free version, which was not touched.

The permanent layer is boring and cheap. My post on security infrastructure for scaling a high-ticket store covers it. The Adobe Commerce BlockStrap patch story shows the same lesson on a different platform.

If a payment gateway key leaves your server, your processor can freeze you. That is why I keep pushing a backup payment processor plan before you need one. Before you spend another dollar on Q4 ads, run the high-ticket Black Friday stress test against the whole store.

If you would rather not own server maintenance at all, that is a fair call. It is a big reason owners hand me the build: my team’s turnkey done-for-you service puts a high-ticket store on a platform with far fewer moving parts than a self-maintained WordPress install. Shopify has its own app risk, as the hijacked apps showed, but you are not running a server.

Not sure whether your WordPress side is exposed? Bring your plugin list to the Skool community and compare notes with other store owners and me. Join the Skool community →

Rank Math PRO Cleanup: What to Do Today

Run these six steps in order. The first one tells you which of the three scenarios you are in.

Check your exposure. Open Plugins in WordPress admin and look for Rank Math PRO. No PRO plugin, no problem. If it is there, find when it was installed or last updated in your host’s file manager or update log, convert that time to UTC and compare it to the window of October 15 at 20:02 through October 16 at 07:12.
Restore if you were inside the window. Roll files and database back to a backup made before October 15 at 20:02 UTC, scan the site with Wordfence or Sucuri, then install 3.0.124. With no clean backup, delete the whole rank-math-pro folder (deactivating is not enough), delete the three wp_options rows, and block rank1cdn.com at the server.
Hunt the leftovers. Run wp user list --role=administrator and look for wpsupport_ accounts. Check for wp-includes/class-wp-cache-util.php, run wp core verify-checksums, and look for .htaccess rules that execute .cache files as PHP. Review wp cron event list and the server crontab for the #ms6v46 tag.
Rotate every secret. Change WordPress passwords, the database login, the salts in wp-config.php, hosting and SSH logins, payment gateway keys and SMTP credentials, and reset admin two-factor. If you send email through Klaviyo, generate new private API keys there and update every integration that used the old ones.
Audit what the attackers could have touched. Crawl the site with a SEMRush site audit to catch injected pages or odd redirects. SE Ranking runs a similar crawl, and Google Search Console shows any security warnings. If customer or lead data lived on that server, talk to a lawyer about notification duties. Dr. Web points to a 72-hour clock under GDPR Article 33 for EU data, and US state rules vary. I am not a lawyer.
Install 3.0.124 last, then schedule the next audit. Download it only after logging in at rankmath.com. Then put a monthly plugin audit on someone’s calendar. A VA from OnlineJobs.ph can run a checklist. Vet the person first, using the process in my post on vetting your VAs.

If you want a second set of eyes on the rest of your stack, book a discovery call. For hands-on help fixing it, look at 1-on-1 coaching.

Frequently Asked Questions

Is the free Rank Math SEO plugin affected?
No. According to BleepingComputer and Rank Math, only the PRO version was hit. The free plugin from WordPress.org, active on more than 4 million sites, was not.

How do I know if my copy was inside the window?
The version number will not tell you, because 3.0.123 was dated October 7. Check when the files landed on your server and compare that to October 15 at 20:02 through October 16 at 07:12 UTC, then follow the three-case guide in the vendor’s notice.

Does updating to 3.0.124 clean a compromised site?
No. Rank Math says deactivating or updating the plugin does not remove the threat. Delete the old plugin folder and the malicious database rows first, then rotate credentials.

Does this touch my Shopify store?
Not directly, since Shopify does not run Rank Math PRO. It touches any WordPress site connected to your business, plus any credential those sites could reach.

Do I have to tell customers?
It depends on what data sat on the server and where your customers live. Dr. Web points to a 72-hour notification window under GDPR Article 33, and I covered the money side in my post on protecting business finances in a legal emergency. A policy generator like Termly helps with the privacy policy, and a lawyer answers the notification question.

Should I stop using premium plugins?
I would not, but I would count them and keep a restore point you trust. My guide to an ecommerce business continuity plan walks through what to have ready.

I do not have a store yet. Should I care?
Care enough to pick a platform with fewer moving parts. Grab the free niches list first. Then read my high-ticket niches breakdown before you choose a stack.

Would you rather not babysit plugin updates at all? Let my team build and run the high-ticket store for you. See the turnkey done-for-you service →

That is the story for now. Check the Plugins screen before you do anything else today, and send this to whoever built your content site. Subscribe to the YouTube channel for daily breakdowns. More breaking news coming through the day.

If this was useful, these go deeper:

Trevor Fenner

Trevor Fenner is an ecommerce entrepreneur and the founder of Ecommerce Paradise, a platform focused on helping entrepreneurs build and scale profitable high-ticket ecommerce and dropshipping businesses. With over a decade of hands-on experience, Trevor specializes in high-ticket dropshipping strategy, niche and product selection, supplier recruiting and onboarding, Google & Bing Shopping ads, ecommerce SEO, and systems-driven automation and scaling. Through Ecommerce Paradise, he provides free education via in-depth guides like How to Start High-Ticket Dropshipping, advanced training through the High-Ticket Dropshipping Masterclass, and fully done-for-you turnkey ecommerce services for entrepreneurs who want a faster, more hands-off path to growth. Trevor is known for emphasizing sustainable, real-world ecommerce models over hype-driven tactics, helping store owners build scalable, sellable, and location-independent brands.