Rank Math SEO PRO: Embedded malware in supply-chain compromise of version 3.0.123
Summary
Rank Math SEO PRO version 3.0.123 packages downloaded or updated in a window of about 11 hours on October 15 and 16, 2026 contained embedded malware. If an affected package was activated, the malware can establish persistent access, recreate hidden backdoors on page visits and expose WordPress and database credentials, API keys and other secrets reachable by the web server. The vendor advises treating such websites as compromised; the free Rank Math SEO plugin is not affected.
Affected
- Rank Math SEO PRO 3.0.123 packages obtained between October 15, 2026 20:02 UTC and October 16, 2026 07:12 UTC
- Only sites that activated an affected package are considered compromised; version 3.0.123 alone is not proof of compromise
- The free Rank Math SEO plugin on WordPress.org is not affected
Fixed in
- Rank Math SEO PRO 3.0.124 (clean replacement; the affected files were removed by the vendor)
- Updating alone does not remove malware already planted on a site
Workaround
- No workaround removes an existing infection.
- A WAF rule is not a mitigation, according to Patchstack.
- Interim measure: block outbound connections to rank1cdn.com at the firewall or DNS.
Exploitation
- The vendor confirms that malicious code was distributed in the affected packages.
- Reports conflict: some outlets say the vulnerability is exploited in the wild, while VulDB and Hol.org state that no known exploitation is recorded. CISA SSVC lists exploitation as none.
- Attack path into the vendor's systems is unknown.
Our recommendation
- Check whether PRO 3.0.123 was installed or updated in the window and whether it was activated.
- For activated sites, treat the website as compromised: restore a backup from before October 15, 2026 20:02 UTC or follow the vendor's full recovery guidance, then rotate all credentials, database passwords and API keys.
- For inactive installs, delete the plugin files, run a security scan and install version 3.0.124 from the Rank Math account.
- Search for the vendor's indicators of compromise, including malicious wp_options keys, unknown administrator accounts and the fake file wp-includes/class-wp-cache-util.php.
- Review firewall and DNS logs for connections to rank1cdn.com.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Rank Math PRO 3.0.123 Security Incident (vendor advisory) rankmath.com
- Rank Math changelog rankmath.com
- Wordfence threat intelligence record www.wordfence.com
- Verisign RDAP record for rank1cdn.com rdap.verisign.com
- VulDB record vuldb.com
- Hol.org CVE record hol.org
- Strix CVE record www.strix.ai
- Freshysites security bulletin freshysites.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:25.
Original description (NVD)
Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a website if the plugin was activated and directs sites that activated an affected package to treat the website as compromised. The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server. Rank Math identifies three malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker as incident indicators. Only packages obtained during the vendor-confirmed window are claimed as affected; version 3.0.123 alone is not sufficient to establish compromise. Rank Math removed the affected files and released version 3.0.124 as the clean replacement.
NVD references (5)
- https://rankmath.com/changelog/
- https://rankmath.com/kb/pro-3-0-123-security-incident/
- https://rdap.verisign.com/com/v1/domain/rank1cdn.com
- https://urlscan.io/result/01a145c2-8dc8-72ff-a65d-21209ca29c4f/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/81cd7a2c-ad0c-4dbc-b5dc-07ec866d5c1f?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.