Summary Points
- Rank Math PRO downloads/updates from Oct. 15, 20:02 UTC–Oct. 16, 07:12 UTC were trojanized; sites that installed and activated them should be treated as compromised.
- Malware can recreate a hidden backdoor and persist through planted files, rogue admin accounts, scheduled tasks, altered
.htaccessrules, or SSH keys. - Assume all secrets accessible to affected sites were exposed, including WordPress, database, hosting, payment, and API credentials.
Threat, Techniques, and Targets
- Rank Math said that copies of its paid Rank Math PRO plugin contained malware if customers downloaded them or received them through an update between 20:02 UTC on October 15 and 07:12 UTC on October 16.
- Therefore, treat any site that installed and activated an affected copy during that period as compromised, even if it now runs version 3.0.124. The incident notice names only Rank Math PRO, not the free plugin from WordPress.org.
- The malware can recreate a hidden backdoor when someone visits the site. It may also leave PHP backdoors, administrator accounts, scheduled tasks, SSH keys, and changes that let certain files run as PHP.
- Neither Rank Math nor Wordfence identified the actor or published an analysis of the malware code.
Impact, Security Implications, and Remediation
- Assume the attackers could access any password, database credential, API key, or other secret available to the site. Wordfence assigned the incident CVE-2026-111862 and a severity score of 9.8 out of 10.
- First, restore the site and database from a backup made before 20:02 UTC on October 15, if one exists. Then scan the site, change all passwords and credentials, and install clean version 3.0.124 from Rank Math’s website.
- If no clean backup exists, follow Rank Math’s cleanup order. Delete the entire Rank Math PRO plugin folder. Next, remove the three listed suspicious entries from the WordPress options table. Then block outgoing connections to rank1cdn[.]com if your hosting provider or firewall allows it.
- After those steps, check site files, administrator accounts, scheduled tasks, SSH keys, and server settings for unauthorized changes. Also change all site, database, hosting, and third party credentials, including security keys and salts.
- Finally, run a security scan and verify WordPress core and plugin files. However, missing indicators or checksum results do not prove that the site is clean. Contact Rank Math support if you are unsure whether the plugin was installed or activated.
Continue Your Tech Journey
Learn how the Internet of Things (IoT) is transforming everyday life.
Stay inspired by the vast knowledge available on Wikipedia.
ThreatIntel-V1
