GajShield Threat Advisory — Rank Math SEO PRO 3.0.123 Supply-Chain Backdoor

Severity: Critical | Priority: 1

Rank Math is a widely used WordPress SEO plugin. The paid “PRO” version 3.0.123 was distributed with a backdoor between October 15, 2026, 20:02 UTC and October 16, 2026, 07:12 UTC. Rank Math removed it and released a clean build, version 3.0.124. Sites that only downloaded 3.0.123 were not affected; the backdoor runs only once the plugin is activated. Once active, it:

• creates rogue administrator accounts (usernames starting with wpsupport_, emails ending in @wp-mail.net)
• plants a fake WordPress core file, wp-includes/class-wp-cache-util.php
• hides code in other plugins, themes, mu-plugins and uploads
• persists through the web server’s crontab, WordPress scheduled events and .htaccess rules that run .cache files as PHP
• rebuilds itself on every page visit, so deleting files alone does not remove it

If an alert is raised, the source is a WordPress server on your network that is running the backdoor and contacting rank1cdn.com. Treat that site as compromised, and keep the block on rank1cdn.com in place. The safest fix is to restore both the site files and the database from a backup taken before October 15, 2026, 20:02 UTC. Then install Rank Math PRO 3.0.124 and run a security scan.

If no clean backup exists, follow the cleanup steps in this order. Because the backdoor rebuilds itself, stop it before removing anything else.

1. Stop the rebuild. Delete the entire rank-math-pro folder; deactivating the plugin is not enough. Then remove the wp_options entries _uf6qdn2hmm, t8krdk990phb and _np5pvf754c.
2. Remove what it planted:
   • Delete unknown administrator accounts and the fake core file.
   • Reinstall WordPress core from an official source.
   • Check mu-plugins, other plugin and theme folders, and uploads for unexpected PHP files.
   • Review .htaccess files, .cache files, crontab entries tagged #ms6v46, and WordPress cron events.
3. Change every credential the site could access:
   • WordPress passwords
   • database credentials
   • the wp-config.php salts and keys
   • API and SMTP keys
   • hosting, SSH and FTP access
4. Verify the cleanup. Run wp core verify-checksums and a security scan. Watch for removed files reappearing; if they do, repeat the cleanup.

Even if no alerts are raised, check every WordPress site you run. If Rank Math PRO was updated or installed during the window, check whether version 3.0.123 was ever activated. Download version 3.0.124 only by logging in to your Rank Math account directly. Rank Math does not send download links by email.