Rank Math PRO 3.0.123 Backdoor: How to Check Your WordPress Site and Clean It Up

Quick answer: If you downloaded Rank Math PRO version 3.0.123 between October 15 (20:02 UTC) and October 16 (07:12 UTC), your copy may contain a backdoor. If you activated it, treat the site as compromised and follow the cleanup steps below. The free Rank Math plugin from WordPress.org is not affected.

What happened

For roughly 11 hours, some copies of Rank Math PRO downloaded from the vendor’s own website were tampered with. It was a supply chain attack: the attackers didn’t break into individual sites, they poisoned the plugin at the source, so anyone who installed that build pulled the malware in themselves.

Rank Math has confirmed the incident in its official security advisory, pulled the bad files and released a clean build, 3.0.124. Security firm Wordfence has also published an analysis, and BleepingComputer reported finding a related malware sample with the same fingerprints.

This matters because Rank Math is one of the most widely used SEO plugins. The free edition runs on more than 4 million sites. Only the paid PRO edition was hit, but PRO users tend to be businesses, agencies and publishers, which are exactly the sites attackers want.

Am I affected? A 60-second check

Answer these three questions:

1. Do you use Rank Math PRO? Go to Plugins → Installed Plugins. If you only see “Rank Math SEO” and no “Rank Math SEO PRO”, you are not affected.
2. Which version is or was installed? Only 3.0.123 is affected. If you are on 3.0.124 or later now, still check: updating does not remove the backdoor if 3.0.123 was ever activated.
3. When did you install or update it? The bad window was October 15, 20:02 UTC to October 16, 07:12 UTC. Automatic updates count.

What the malware does

According to Rank Math’s advisory, the malicious code is built to stay hidden and keep coming back:

• Persistent access: it plants a backdoor file at wp-includes/class-wp-cache-util.php, a name chosen to look like a normal WordPress core file.
• Self-repair: it recreates its hidden backdoors when someone visits the infected site, so deleting one file is not enough.
• Remote control: it talks to a server at rank1cdn(.)com.
• Secret theft: anything the web server can read is at risk: database passwords, API keys, and (per the related sample BleepingComputer analyzed) cloud credentials for AWS, Google Cloud, Azure and Cloudflare, plus SSH keys.
• Hidden admins: it can create administrator accounts whose usernames start with wpsupport_ and whose emails end in @wp-mail.net.

How to check your site for signs of infection

These are the fingerprints (indicators of compromise) published for this attack. Finding any one of them means you should do the full cleanup.

From the WordPress dashboard

1. Open Users → All Users and filter by Administrator. Look for any username starting with wpsupport_ or any email ending in @wp-mail.net. Also check for any admin you don’t recognize.
2. If you use a security plugin such as Wordfence, run a full scan with “scan core files against repository versions” turned on. It will flag class-wp-cache-util.php as a file that shouldn’t exist.

From your hosting file manager

1. Look inside the wp-includes folder for class-wp-cache-util.php. That file is not part of WordPress.
2. Search your files for the text rank1cdn. Most hosting file managers have a search function.

With WP-CLI (if your host offers SSH)

# Any admin accounts that match the attacker's pattern?
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

# Do core files match the official release? Extra files are flagged too.
wp core verify-checksums

# Any reference to the attacker's server in your files?
grep -rl "rank1cdn" wp-content/ wp-includes/

# Database markers named in the advisory
wp db search "_np5pvf754c" --all-tables
wp db search "xmmqhn" --all-tables

# Scheduled jobs: WordPress cron and the server crontab
wp cron event list
crontab -l | grep "ms6v46"

How to clean up an infected site

The most important point: deactivating or updating the plugin does not remove the infection. The backdoor lives outside the plugin folder.

Option 1: restore from a clean backup (best)

1. Restore both files and database from a backup taken before October 15.
2. Install Rank Math PRO 3.0.124 or later fresh from your Rank Math account.
3. Do every step under “After either option” below. A restore does not undo stolen passwords.

Option 2: manual cleanup (no clean backup)

1. Put the site in maintenance mode and take a full backup of the infected state, in case you need it for investigation.
2. Delete the entire Rank Math PRO plugin folder, then install a fresh 3.0.124 copy.
3. Delete wp-includes/class-wp-cache-util.php, then reinstall WordPress core (Dashboard → Updates → Re-install, or wp core download --force --skip-content).
4. Remove the malicious database entries (_np5pvf754c) and any scheduled task marked #ms6v46.
5. Delete every unknown administrator account, especially wpsupport_* users.
6. Look for other changes: recently modified PHP files in wp-content/uploads, unfamiliar plugins or mu-plugins, and edits to .htaccess or wp-config.php.
7. Rescan. If anything comes back, assume there is a backdoor you haven’t found and consider a professional cleanup.

After either option

• Change every password: WordPress admins, hosting panel, FTP/SFTP, and the database user (update wp-config.php to match).
• Reset your security keys: generate new salts in wp-config.php (or run wp config shuffle-salts). This logs everyone out, including the attacker.
• Rotate API keys and cloud credentials stored on the server: payment gateways, email services, AWS, Cloudflare, Google Cloud, Azure, and any SSH keys.
• Block the attacker’s server: ask your host to block outgoing connections to rank1cdn(.)com.
• Watch for a few weeks: new admin users, unexpected file changes, and sudden spam pages in Google Search Console.

Our take: what WordPress site owners should learn from this

This attack didn’t depend on weak passwords or an outdated plugin. Users who did the “right thing” and installed the latest official version were the ones who got hit. That is what makes supply chain attacks so dangerous, and why a few habits matter:

• Delay auto-updates for premium plugins by a day or two on business-critical sites. Most supply chain compromises are caught within hours.
• Keep off-site backups going back at least 30 days. A backup from last night doesn’t help if the infection arrived last week.
• Don’t store more secrets on the web server than it needs. If a backdoor can read your AWS keys, so can the attacker.
• Use file-integrity monitoring. A new file in wp-includes should never go unnoticed.

Frequently asked questions

Is the free Rank Math plugin safe?

Yes. Rank Math says only the PRO edition downloaded from its website was affected. The free version on WordPress.org was not touched.

I updated to 3.0.124. Am I safe now?

Only if 3.0.123 was never activated on your site. If it was, the backdoor sits outside the plugin and survives the update, so you still need to clean up.

I downloaded 3.0.123 but never activated it. What should I do?

Delete it, install 3.0.124 and run a security scan. The risk is low, but the scan confirms nothing ran.

How many sites were affected?

Rank Math has described it as a limited number of users but has not published a figure. We’ll update this article if that changes.

How did the attackers get in?

That hasn’t been disclosed yet. We’ll update this article when Rank Math shares more.

Sources: Rank Math security advisory, Wordfence, and reporting by BleepingComputer.