Rank Math PRO Malware: How to Check and Recover Your Sites

On October 15–16, 2026, some official copies of Rank Math PRO 3.0.123 contained malware. If your client sites use Rank Math PRO, here’s how to find the affected sites, how to clean them up, and where WP Umbrella can help.

The Rank Math PRO 3.0.123 incident explained

On October 15, 2026, attackers added malware to some copies of Rank Math PRO 3.0.123. These copies reached sites through rankmath.com downloads and normal plugin updates. So a site could install the malware just by updating the plugin as usual.

Rank Math found the problem the next morning, removed the bad files, and released a clean version, 3.0.124.

In local time, the incident window ran from 22:02 to 09:12 in Paris, and from 16:02 to 03:12 in New York.

The malware installed a backdoor: a hidden way into the infected sites that let an attacker get back in without a password. According to Rank Math, it can also:

• Reinstall itself after being deleted
• Hide copies of itself in other plugins and themes
• Create new admin users
• Add a fake file that looks like part of WordPress
• Change server settings and add tasks that run automatically.

The malware can also read the site’s sensitive data: passwords, the database login, and API keys (codes that connect the site to services like payments or email). That’s why it’s advisable to change all of them.

These tricks make it hard to remove. Just deleting the Rank Math PRO plugin isn’t enough, because the malware could already be in other places on the site.

How to recover an affected site, step by step

Before you start, make a list of every site that runs Rank Math PRO 3.0.123, then check if any of those got an update on October 15–16, 2026, while the security attack was happening.

Once you identify the sites that need recovery, check whether you have a clean backup from before the incident window.

Path A: You have a backup from before the incident window

This is the fastest and safest option.

1. Restore the site’s files and database from a backup made before October 15 at 20:02 UTC.
2. Scan the site for malware.
3. Change every password and key on the list below.
4. Install 3.0.124, downloaded from your Rank Math account.

Path B: You don’t have a clean backup

Follow these steps in order. If you skip ahead, the malware can reinstall itself.

Step 1: Stop the malware from coming back.

• Delete the whole rank-math-pro plugin folder. Deactivating the plugin isn’t enough.
• Delete three rows from the wp_options database table: _uf6qdn2hmm, t8krdk990phb and _np5pvf754c.
• Ask your host to block the site from connecting to rank1cdn[.]com.

Step 2: Find and remove what the attacker left behind.

Look for	Where
Admin users named wpsupport_ + random letters, or with an email ending in @wp-mail[.]net	Users, in the WordPress dashboard
A file named class-wp-cache-util.php (it’s fake, WordPress doesn’t have this file)	wp-includes folder
PHP files you don’t recognize	mu-plugins, uploads, other plugin folders, and theme folders named inc, includes or lib
Rules that make .cache files run as code	.htaccess file
Scheduled tasks you didn’t create, including one tagged #ms6v46	WordPress scheduled tasks and the server’s crontab
SSH keys you don’t recognize	Server SSH settings

Step 3: Check that the site is clean.

• Scan the site again.
• Verify that WordPress core files are original.
• Watch for deleted files coming back. If they do, the malware is still active.

For both paths: change every password and key

The backup removes the malware, but it can’t undo what the attacker already saw. As soon as you can, change every password and key related to the site.

• All WordPress user passwords
• The database password
• The security keys and salts in wp-config.php (random codes WordPress uses to protect logins)
• API keys for payments, email and other services
• Hosting, FTP, SFTP and SSH logins
• Two-factor login for admin accounts, where needed

Why a firewall can’t block this malware

Patchstack rates the issue as a high-priority backdoor, with a severity score of 9.8 out of 10 (CVE-2026-111862). It also explains that a virtual patch isn’t possible in this case.

A virtual patch is a firewall rule that stops attackers from using a known vulnerability in a plugin, until you install the developer’s fix. It’s the technology behind the firewall in WP Umbrella’s Security Add-on.

This time, the malware didn’t use a vulnerability. It was already inside the Rank Math PRO files when they reached the site, so there was nothing for a firewall to block.

What protects your portfolio from similar incidents

Attacks that hide malware inside a real plugin update have become more common in 2026. Rank Math PRO is the third case this year. Previously, a similar security incident happened to Smart Slider 3 Pro and ShapedPlugin Pro. Each time, the company released a clean version quickly.

You can’t stop attackers from going after a plugin you trust, but some measures help you spot a problem early and recover without stress.

1. Keep backups you can go back to

Security incidents show how valuable a clean backup is. WP Umbrella backs up your sites automatically, on the schedule you choose. When you need a backup, you can restore it from your dashboard in one click, either the whole site or only the files or database you need.

2. See every plugin and version in one place

If you manage a big portfolio of client sites, when a plugin has a security problem, the first question is “which of my sites use it?” If you have to log in to each site to check, that takes hours.

WP Umbrella shows the plugins and versions on all your sites in one dashboard. You can filter and sort your portfolio for clear overview and quick reactions. Additionally, with the MCP connector, you can simply ask your AI assistant which sites are affected, and get the answer in plain language.

3. Install security updates fast

Attackers often start exploiting a new vulnerability within hours, that’s why security fixes should go in as soon as they become available. Updates that only add features can usually wait a day or two.

WP Umbrella’s priority security updates install security fixes as soon as they’re released, while your other updates follow your normal schedule.

4. Watch for signs of an attack

Malware is built to stay hidden, so it’s hard to notice just by looking at a site. Two tools can help a lot: a malware scanner and an activity log.

• A malware scanner checks a site for harmful code. WP Umbrella’s scanner runs every day on our servers, so it doesn’t slow your sites down, and it alerts you when it finds something that needs your attention.
• An activity log records what happens on the site and warns you about unusual changes. WP Umbrella’s Security Activity Log flags signs like new or hidden admin accounts, changes to core files and changes to .htaccess. These are the same kinds of changes the Rank Math PRO malware made.

Both tools come with the Security Add-on, which you can turn on for the sites where an attack would cost your client the most.

5. Harden every site from day one

Many WordPress security attacks rely on the same weak spots, like an open file editor or admin accounts without two-factor login. Closing them makes it harder for attackers to get in or stay in.

WP Umbrella’s hardening controls are included with every site at no extra cost. Turn each one on with a simple toggle to close the doors attackers usually try first.

6. Keep your plugin list short

Every plugin is one more update you have to trust. Delete plugins a site no longer needs, including inactive ones, because their files stay on the server.

WP Umbrella’s site health checks flag inactive plugins and themes, so you can see what to remove on every site.

7. Write an incident plan now.

Decide who checks the sites, who contacts clients and when to call experts. Section 2.0 of our free Complete WordPress Security Guide includes a step-by-step incident response plan that you can adapt to your own workflow.

And if a cleanup is more than your team can handle, WP Umbrella is here to help with two on-demand services:

• Security Audit (€30 per site): our team reviews your site in detail. You get a clear report of what happened and what to fix first.
• Managed Malware Cleanup (€180): our team takes care of everything. We remove the malware, close the way in, reinstall clean copies of WordPress and your plugins, and harden the site.

Final Thoughts

The Rank Math PRO incident is a reminder that even popular plugins from respected companies can be targeted in a security attack. Rank Math responded quickly and shared clear guidance. Still, for a few hours, a routine update was enough to put sites at risk, even though the site owners did nothing wrong.

For WordPress agencies, the lesson is to prepare for the day something slips through. When you already have clean backups, a clear view of every plugin across your sites, and tools that warn you about unusual changes, an incident like this becomes a few minutes or hours of focused work, instead of a crisis that might cost you a client.