Rank Math PRO 3.0.123 Malware Cleanup
wp-content » plugins » Rank Math PRO 3.0.123 Malware: How to Check and Clean Your Site

Rank Math PRO 3.0.123 Malware: How to Check and Clean Your Site

by

If you run Rank Math PRO and the site updated to 3.0.123, you probably have malware. Some 3.0.123 packages served between October 15, 2026, 20:02 UTC and October 16, 2026, 07:12 UTC contained a backdoor that activates as soon as the plugin is activated. The clean release is 3.0.124. The free Rank Math SEO plugin from WordPress.org is not affected.

Updating to 3.0.124 is not enough on its own. According to the official Rank Math incident page, the malware stores itself in the database, recreates a hidden backdoor on page visits, drops fake core files, changes .htaccess, and adds cron jobs. Below is exactly what I check and remove, in order. As of 2026-10-20, this is based on the vendor advisory and SecurityWeek’s report. Check the advisory again in case the list of indicators has changed.

Check the installed version in Plugins, or run this from SSH:

wp plugin list --fields=name,status,version | grep -i rank-math
  • 3.0.123 installed and activated during the window: treat the site as compromised and follow the steps below.
  • Installed but never activated: delete the plugin files, install 3.0.124 from your rankmath.com account, and run a malware scan.
  • Only downloaded the zip: the advisory doesn’t treat that as a compromise. Delete the zip anyway.

Restore both the files and the database from a backup taken before October 15, 2026, 20:02 UTC (16:02 EDT). Then scan the site, rotate every credential (see below), and only after that install 3.0.124. If you restore and skip the credential rotation, the attacker can still use any keys they stole.

If you don’t have a clean backup, take a full backup of the current (infected) state first so you have something to compare against. Then work through these steps in order. Run all commands from the WordPress root.

Step 1: stop it from rebuilding itself. Delete the whole plugin folder, because deactivating it doesn’t remove the backdoor. Then delete the three malicious options:

rm -rf wp-content/plugins/rank-math-pro

wp option delete _uf6qdn2hmm t8krdk990phb _np5pvf754c

Without WP-CLI, run the same thing in phpMyAdmin. Change wp_ if your table prefix is different:

SELECT option_name FROM wp_options
WHERE option_name IN ('_uf6qdn2hmm','t8krdk990phb','_np5pvf754c');

DELETE FROM wp_options
WHERE option_name IN ('_uf6qdn2hmm','t8krdk990phb','_np5pvf754c');

Next, block outgoing connections to rank1cdn.com. On a VPS where you have root access, the quickest way is to add it to the hosts file. On shared hosting, ask your host to block it at the firewall:

echo "0.0.0.0 rank1cdn.com" | sudo tee -a /etc/hosts

Step 2: find what it changed. Start with rogue admins. The advisory says to look for usernames starting with wpsupport_ and emails ending in @wp-mail.net:

wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

# delete a rogue admin and give their content to your real admin (ID 1 here)
wp user delete 123 --reassign=1

The malware drops a fake core file, wp-includes/class-wp-cache-util.php. Delete it, then check the core files against WordPress.org checksums with wp core verify-checksums:

rm -f wp-includes/class-wp-cache-util.php
wp core verify-checksums --include-root

If anything else shows up as modified, don’t edit it by hand. I reinstall core instead, as described in Reinstall WordPress Core using WP-CLI.

Next, search for .cache files that contain PHP, .htaccess rules that make .cache files run as PHP, PHP files in uploads, and the known code markers. Those markers are the key xmmqhn, proc_open, and base64_decode combined with XOR loops:

# .cache files containing PHP (also check outside the site root, e.g. your home dir)
find . -type f -name "*.cache" -exec grep -l "<?php" {} +

# .htaccess files mentioning .cache (handlers like AddType/AddHandler/SetHandler)
find . -name ".htaccess" -exec grep -Hn -i "cache" {} + | grep -iE "addtype|addhandler|sethandler|php"

# PHP files in uploads should not exist
find wp-content/uploads -type f -name "*.php"

# known markers
grep -rl --include="*.php" -e "xmmqhn" -e "proc_open" wp-content/ wp-includes/

Pay particular attention to wp-content/mu-plugins/, other plugins’ folders, and the inc/, includes/ and lib/ folders of non-default themes. Some legitimate plugins use proc_open, so read each match before you delete it.

See also  IDBTE4M BOT V87 🤖

Then check cron, at both the WordPress level and the system level. The advisory says the malicious system crontab entries are tagged #ms6v46:

wp cron event list
crontab -l | grep -n "ms6v46"

# remove tagged lines (review the output of crontab -l first!)
crontab -l | grep -v "ms6v46" | crontab -

Finally, check outside WordPress. That means ~/.ssh/authorized_keys, crontabs belonging to other system users, running processes (ps aux), and anywhere else the web server user can write to. The advisory says the changes may reach beyond the WordPress install, so don’t stop at public_html.

The malware can expose credentials, API keys and other secrets, so rotate all of them:

  • All WordPress user passwords, and turn on 2FA for admins.
  • The database password. Change it in your panel first, then update DB_PASSWORD in wp-config.php.
  • Salts and security keys. Run wp config shuffle-salts or use the WordPress salts generator. This logs everyone out.
  • Payment gateway, SMTP and third-party API keys.
  • Hosting panel, FTP/SFTP and SSH credentials, plus any environment variables.
wp core verify-checksums
wp plugin verify-checksums --all

wp plugin verify-checksums only works for plugins hosted on WordPress.org. Compare premium plugins against fresh copies from the vendor instead. Run a Wordfence or Sucuri scan, then watch outbound connections for several days. If a file you deleted comes back, something persistent is still there. Go back to Step 2, or hand the site to a professional. My complete guide to cleaning a hacked WordPress site covers the rest of the process.

Only download 3.0.124 by going to rankmath.com yourself and logging in. Rank Math says it never sends login or download links by email, so any “here’s your patched version” email is phishing.

In cPanel, you’d use Cron Jobs to review the account crontab and Terminal (if your host enables it) to run the commands above. In OpenPanel, WP-CLI is preinstalled in every PHP container. You run it from Containers → Terminal on Enterprise, or by creating a cron job in the site’s PHP container and clicking Run to see the output right away. Add --path and --allow-root, for example wp user list --role=administrator --path=/var/www/html/example.com --allow-root. The Cron Jobs page is also where you’d look for the #ms6v46 entries.

You couldn’t have stopped a poisoned update from a vendor you trust, but you can limit the damage. Keep daily off-site backups with enough retention to go back before an incident. Delay auto-updates for premium plugins on high-value sites by a day or so. Block PHP execution in uploads/. Monitor file changes, and alert on new admin accounts. Not sure whether a site is still dirty? Use my checklist on how to tell if your WordPress site is hacked.

If Rank Math PRO 3.0.123 was activated between Oct 15, 20:02 UTC and Oct 16, 07:12 UTC, 2026, treat the site as hacked. The best fix is to restore a backup from before the window. Otherwise, delete rank-math-pro/, delete the options _uf6qdn2hmm, t8krdk990phb and _np5pvf754c, and block rank1cdn.com. Remove wpsupport_* admins, class-wp-cache-util.php, PHP in .cache files and #ms6v46 cron lines. Then rotate every credential and salt, and install 3.0.124 from your rankmath.com account.

Was this post helpful?

Leave a Comment

I enjoy constructive responses and professional comments to my posts, and invite anyone to comment or link to my site.

Recommended