Rank Math PRO malware: check your site tonight, in this order

Rank Math PRO malware is the kind of headline that sends you to the Plugins screen late at night, squinting at a version number and wondering what it means for your site. The answer depends on three things you can check in about ten minutes: which copy you have, when you got it, and whether you activated it.

Rank Math says a limited number of PRO v3.0.123 downloads contained malware between October 15, 2026, at 20:02 UTC and October 16, 2026, at 07:12 UTC. If you activated a copy from that window, treat the site as compromised and start recovery tonight. If you did not, your steps are much smaller.

Your passwords belong in the plan too, because credentials the site could reach should be replaced after an activated copy. The order matters, since a quick update can look like a fix while leaving a way back in.

Find out in ten minutes whether your copy is one of the risky ones

Open your WordPress dashboard directly, not through a remote management tool, and go to Plugins. Find Rank Math PRO and write down the version, whether it is active, and the date it was last updated. WordPress explains this screen in its Plugins screen documentation.

Then open the Users screen and look for administrators you did not add. If you got an incident email from Rank Math, keep it handy. Do not activate, test or reinstall a suspect copy just to see what it does.

Your hosting panel or backup tool may show times in your own time zone, so convert to UTC before you compare anything against the window.

The details come from Rank Math's incident notice and Wordfence's advisory. Wordfence lists the issue as CVE-2026-111862, unauthenticated embedded malicious code, rated 9.8 on the CVSS severity scale. Patchstack and the GitHub advisory carry matching records.

Get back to a clean site by restoring from before the window

If your copy was activated, the best route is a restore. Rank Math recommends restoring both the files and the database from a backup made before October 15, 2026, at 20:02 UTC. Check the date on that backup before you trust it, because a backup taken during or after the window can carry the problem with it.

After the restore, scan the site. Reinstall plugins and themes from trusted sources rather than reusing copies already sitting on the server. Only then install Rank Math PRO v3.0.124, downloaded from your own Rank Math account.

That order is deliberate. Installing the fixed version on a site that is still compromised replaces the plugin package, but it may not remove accounts or scheduled tasks the earlier copy already created.

Clear the way back in when you have no clean backup

Without a usable backup, the work is manual and the sequence matters. Rank Math says to start by deleting the entire `rank-math-pro` folder, removing the three named malicious `wp_options` entries, and blocking outgoing connections to `rank1cdn.com` if your host lets you. The exact entry names are listed in Rank Math's notice, so copy them from there rather than from memory.

Once those are done, look further. Inspect your files, users, cron jobs, server access and uploads. Unfamiliar administrators, scheduled tasks you did not create and unexpected files in the uploads folder all deserve a close look.

A clean scan does not prove the site is clean, and one deleted file does not close the matter. If you are not comfortable in the database or on the server, this is the point to bring in help. Wordfence's write-up lists the technical indicators.

For the first hours after any hack, our guide to what to do in the first 24 hours after a website is hacked covers the steps that apply to every incident.

Take back your keys by replacing every password the site could reach

Rank Math says credentials accessible to the site should be replaced. Do this after the site is clean, or from a device and network you trust, so a new password is not handed straight back to something still running on the server.

Changing the WordPress admin password alone is not enough. Anything stored on, or reachable from, the site belongs on the list.

Rotating the salts logs out everyone currently signed in, which is the intended effect. Reset two-factor authentication on accounts that had it, then sign back in from a device you trust.

If the site stores customer or payment information, our post on telling customers about an online store data breach covers what comes next.

Keep this separate from the UpdraftPlus incident and the free Rank Math plugin

You may have seen another WordPress security story this week. In the UpdraftPlus and UpdraftCentral incident, the problem was stolen UpdraftCentral connection keys; here, the malware was inside some Rank Math PRO downloads themselves. The cleanup steps differ, so follow each notice for its own incident.

The free Rank Math SEO plugin from WordPress.org is not named as affected. If you use only the free version, this incident does not call for action. If you are not sure which one you have, look for Rank Math PRO by name on the Plugins screen.

Sites that never downloaded PRO v3.0.123 during the window are outside this incident. Your normal plugin habits still apply, though.

Lower the odds of a repeat with a few habits for every premium plugin

This event shows that a vendor's own download channel can be the route in, which is worth planning around. Rank Math removed the bad packages and released v3.0.124 on October 16. A few habits limit the damage from any plugin, from any vendor.

• Download only from the vendor's account: or from another source the vendor names. Skip unofficial ZIP files, redistributed copies and download links in unsolicited email.
• Keep a tested backup before every update: A backup you have never restored is a guess. WordPress covers the basics in its backup guidance.
• Delete plugins you do not use: A deactivated plugin still sits on your server. WordPress's hardening guidance says to keep plugins updated, remove unused ones and keep reliable backups.
• Decide how updates reach you: WordPress supports automatic updates plugin by plugin. Turn them on according to the vendor's confirmation and your rollback plan.

If keeping up with this is a chore, a website maintenance plan handles tested backups, update management and monitoring on a schedule. Our guide to checking WordPress plugins for urgent security updates and the post on what a plugin vulnerability warning means cover the everyday version of this routine.

Know when a self-check is not enough and a professional should step in

The ten-minute check tells you whether your site falls inside this incident. It does not prove that a compromised site is clean afterward. Some situations call for a second pair of hands.

• You activated an affected copy from the window.
• You are unsure of the backup date.
• The site holds payment or customer data.
• You have limited access to the server.
• Suspicious files or accounts come back after cleanup.

A proper review preserves evidence, removes persistence in the right order, restores trusted files, replaces connected credentials and confirms the result. It is investigation sized to what the evidence shows, not an automatic rebuild. If your copy never ran, you may be done after the checks and the v3.0.124 swap.

If the cost of a cleanup is on your mind, our post on website malware removal cost lays out what drives the price.

Frequently Asked Questions About Rank Math PRO Malware

Was the free Rank Math SEO plugin affected?

No. Rank Math says the incident concerns Rank Math PRO, and the free Rank Math SEO plugin from WordPress.org is not named as affected.

Does version 3.0.123 mean my site was hacked?

Not by itself. Only some v3.0.123 downloads between October 15, 2026, at 20:02 UTC and October 16, 2026, at 07:12 UTC carried malware. Check the download time and whether the copy was activated.

What if I activated an affected copy?

Treat the site as compromised. Restore files and the database from a backup made before the window, scan, reinstall plugins and themes from trusted sources, then install v3.0.124.

Is updating to Rank Math PRO 3.0.124 enough?

No. The update replaces the package, but it may not remove backdoors, accounts or scheduled tasks an activated copy already created.

What do I do first if I have no clean backup?

Delete the full `rank-math-pro` folder, remove the three named `wp_options` entries and block outgoing connections to `rank1cdn.com` if possible. Then inspect files, users, cron jobs, server access and uploads.

Which passwords should I change?

WordPress, database, hosting, FTP, SFTP, SSH, API, payment and email credentials, plus salts and two-factor settings. Do it once the site is clean or from a device you trust.

Moving Forward

You now know which copy decides your next step. An activated v3.0.123 download from the October 15 to 16 window means recovery: restore from a backup made before the window, scan, reinstall from trusted sources, install v3.0.124, and replace the credentials the site could reach. A copy that never ran needs a swap and a scan, and the free Rank Math SEO plugin needs nothing for this incident.

Doing it in order is what protects you. A clean restore, rotated passwords and a tested backup mean the next plugin notice can be handled in an afternoon instead of a weekend. If you ever want a site with no plugin directory to patch, a hand-built web design project removes this kind of plugin supply-chain exposure, though hosting and third-party services still need care, so it lowers risk rather than ending it.

If your copy was activated, your backup date is unclear or the site holds customer data, Web Leveling can run a website security audit that checks files, users, scheduled tasks and credentials in the right order. We work with small and medium businesses across the country and overseas. Tell us which Rank Math PRO copy you have and when you got it, and we will tell you what the next step is.

Terms