Let's build a website that works as hard as you do.
Get a fast, SEO-ready WordPress website built around your business, not a template.
We usually tell clients the same thing: keep your plugins updated. This week the update itself was the attack. Rank Math, the maker of an SEO plugin for WordPress, says some copies of its paid version, Rank Math PRO 3.0.123, “contained malware that could compromise your website if the plugin was activated.”[1] The bad copies went out for about 11 hours, through normal downloads and updates. Here is who is affected, why updating again does not undo it, and what we found when we checked the sites on our servers.
What happened
Rank Math says the affected copies were downloaded “between October 15, 2026, at 20:02 UTC and October 16, 2026, at 07:12 UTC”.[1] In Malaysia and Singapore time, that is 16 October, 4:02 am to 3:12 pm. Rank Math removed the files and released a clean version, 3.0.124. Wordfence lists the incident as CVE-2026-111862 with a severity score of 9.8 out of 10.[2]
Rank Math’s notice covers the PRO plugin only. It does not mention the free version.[1]
Why updating to 3.0.124 is not enough
A normal security fix closes a hole that nobody has used yet. This is different: on an affected site, the malware has already run. Wordfence puts it plainly: “Simply updating the plugin is not enough because the malware may have placed additional files, administrator accounts, or scheduled tasks elsewhere on the server.”[2]
Rank Math’s own list of signs to look for includes:[1]
- administrator accounts with usernames starting
wpsupport_, or email addresses ending in@wp-mail[.]net - three entries in the
wp_optionstable:_uf6qdn2hmm,t8krdk990phband_np5pvf754c - a file called
wp-includes/class-wp-cache-util.php, which Rank Math says is not part of WordPress .cachefiles containing PHP code, and.htaccessrules that let them run- a server scheduled task marked
#ms6v46, and connections torank1cdn[.]com
The version number alone does not prove anything either way. Wordfence notes that “Version 3.0.123 by itself does not prove that a website was compromised”: what matters is whether the copy was downloaded in that window and then activated.[2]
What we checked on 18 October
We ran a read-only check that changed nothing on the sites. On the 11 WordPress sites we can log in to, including our own, it looked for every Rank Math plugin, the three database entries, wpsupport_ and @wp-mail.net accounts, the fake core file, .cache files containing PHP, matching .htaccess rules, and the must-use plugins folder. For the other WordPress sites on servers we run, we checked from outside whether the Rank Math plugin files exist.
| What we checked | Result |
|---|---|
| Rank Math (free or PRO) installed, 11 sites we log in to | None |
The three wp_options entries | Not found on any of the 11 |
wpsupport_ or @wp-mail.net accounts | None. No administrator account on any of the 11 was created during or after the incident window |
Fake class-wp-cache-util.php file | Not present on any of the 11 |
.cache files containing PHP, and .htaccess rules for them | None found in about 287,000 files in wp-content or in the main .htaccess files (on one site the file scan stopped at its time limit partway through) |
| Rank Math plugin files, 22 more sites on our servers (checked from outside) | Not present on any of them |
One detail for anyone checking their own site: Rank Math’s notice says to delete the rank-math-pro folder.[1] When we requested the file paths on 18 October, rankmath.com itself served the PRO plugin’s main file from a folder called seo-by-rank-math-pro, not rank-math-pro. Look for either name.
Our view: an update you didn’t write is still code you run
Every plugin update is a small piece of trust: you let someone else’s code onto your server. Almost always that trust is right, and skipping updates is far riskier than taking them. But this incident shows why updates alone aren’t a security plan. Two other things decide how bad a day like this is.
- A backup from before the bad update. Rank Math’s recommended fix is to restore “from a backup created before the incident began”.[1] On the two sites we looked at on our servers, automatic backups run every 12 hours and go back about 30 days. On one, the last backup before the window was taken at 15:44 UTC on 15 October, about four hours before the bad copies went out.
- Fewer plugins, chosen on purpose. A plugin you don’t install can’t be the next supply-chain story. None of the sites we checked uses Rank Math, which is why our answer this week was a check rather than a clean-up. Two days later came stolen UpdraftCentral keys being used to install backdoors, a reminder that remote connections need the same care as plugins.
It is the point we made in our guide to managed vs unmanaged hosting: whoever runs a site has to know what is installed and keep backups.
What not to do
- Don’t just update to 3.0.124 and move on if your site took 3.0.123 during the window. Follow the clean-up first.
- Don’t just deactivate the plugin. Rank Math says: “Deactivating the plugin alone is not sufficient.”[1]
- Don’t skip the password change after restoring a backup. Rank Math: “This step is essential, even if you restore your website from a backup.”[1]
- Don’t click download or password-reset links in emails about this. Rank Math says “We will never send login or download links by email.” Go to rankmath.com directly.[1]
Check it yourself
- Do you use Rank Math PRO? In WordPress, go to Plugins and look for Rank Math SEO PRO and its version number.
- When did it update? If it moved to 3.0.123 between 4:02 am and 3:12 pm Malaysia time on 16 October, treat the site as affected and follow Rank Math’s notice.[1]
- Look at your administrators. Go to Users, filter by Administrator, and question any name you don’t recognise, especially one starting
wpsupport_. - Ask your host one question in writing: “Do you have a full backup of my site from before 15 October 2026, 20:02 UTC?” If the answer is no, you have found the bigger problem.
Frequently asked questions
Is my site affected by the Rank Math PRO 3.0.123 malware?
Only if your site downloaded or updated to Rank Math PRO 3.0.123 between 15 October 2026 at 20:02 UTC and 16 October 2026 at 07:12 UTC (16 October, 4:02 am to 3:12 pm Malaysia time) and the plugin was then activated. The version number alone does not prove a compromise.
Is updating to Rank Math PRO 3.0.124 enough?
No, not if an affected copy was active. The malware may have added files, administrator accounts or scheduled tasks elsewhere. Rank Math recommends restoring a backup from before the incident, scanning the site, changing every password and key, and then installing 3.0.124.
Is the free Rank Math plugin affected?
Rank Math’s security notice covers Rank Math PRO 3.0.123 only and does not mention the free plugin.
If you think your site is affected
We are a web design and SEO studio, not a cybersecurity firm, and we don’t offer security investigations or malware clean-up as a service. If you think your site is affected, contact your hosting provider and, for a plugin problem, the plugin’s maker first. If your site may have been hacked, use a specialist security service; the sources listed below explain what they will look for.
What we write here is what we check on the websites we build and host for our own clients. If you are planning a new website, or want a second opinion on your current site’s design and SEO, request a free written review.
References
- Rank Math, “Rank Math PRO 3.0.123 Security Incident: How to Secure Your Website”, 16 October 2026, updated 17 October 2026. Accessed 18 October 2026.
- Wordfence, “PSA: Malware Found in Some Rank Math SEO PRO 3.0.123 Downloads”, 16 October 2026. Accessed 18 October 2026.
- Total Web Solutions records: read-only Rank Math indicator check of the 11 WordPress sites we can log in to, public plugin-file check of 22 more sites on our servers, and automatic-backup schedules on two sites, 18 October 2026.
