Rank Math PRO malware could compromise WordPress sites

The malware could recreate a backdoor on each visit

Rank Math said the malware could recreate its hidden backdoor whenever someone visited the website. The vendor also instructed affected users to remove the entire Rank Math PRO plugin folder because deactivating the plugin alone was not sufficient.

Rank Math instructed users to find and delete a malicious entry in the wp_options table when its option_name matched the listed value _uf6qdn2hmm.

Wordfence rated the compromise 9.8 on CVSS

Wordfence said it classified the event as a supply-chain compromise and rated it 9.8 on the CVSS scale, the Critical tier. It is tracked as CVE-2026-111862.

Rank Math said copies of Rank Math PRO downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware.

Rank Math said it removed the affected files and released Rank Math PRO v3.0.124 as a clean version. The company said the free version of Rank Math SEO available on WordPress.org was not affected.

Rank Math’s recovery guidance says users who activated the affected version should restore their website and database from a backup created before the incident began and replace credentials and secrets accessible to the compromised website.