WordPress problem fix
Updating to 3.0.124 removes the bad plugin files. It does not remove backdoors that were already planted or change the passwords that were exposed.
Rank Math says that some copies of Rank Math PRO version 3.0.123 downloaded from its own website between 20:02 UTC on 15 October and 07:12 UTC on 16 October 2026 contained malware. If one of those copies was activated, the vendor says the site should be treated as compromised. The malware set up hidden backdoors that rebuild themselves when the site is visited, talked to a domain called rank1cdn, and exposed database passwords, API keys and other secrets the server can read. The free Rank Math plugin from WordPress.org was not affected. The clean release is 3.0.124. Installing it is step one, but you also need to remove anything the malware planted and change every secret it could have read.
If any of these match, you are on the right page.
You updated or installed Rank Math PRO on 15 or 16 October 2026
Your plugin history shows Rank Math PRO 3.0.123
Files you do not recognise appear in wp-content, often with cache or preloader style names
Your server makes outbound connections you cannot explain
Deleted files come back after a page load
This was a supply chain attack. The attacker got into the vendor's download system, so the infected file came from the place you were told to trust. Other WordPress products, including BuddyBoss earlier in 2026, were hit the same way.
The malware was designed to persist. It planted extra backdoors outside the plugin folder that restore themselves. Removing the plugin files leaves those behind, and any passwords or keys already stolen still work until you change them.
Rank Math says only the PRO version from its own site was affected and the free version on WordPress.org was clean.
The real method, in the order it works.
Check when Rank Math PRO was last updated and whether 3.0.123 was ever active.
Update to 3.0.124 or later straight away.
Follow the vendor's cleanup advisory, then scan the whole of wp-content and the database for files and entries that should not be there.
Remove leftover backdoors and confirm nothing comes back after several page loads.
Change the database password and the security keys in wp-config.php.
Rotate every API key the site stores: payment, email, CRM, analytics, CDN.
Change admin, hosting and FTP passwords and log out all users.
How we handle it
This page is based on Rank Math's own advisory and BleepingComputer's reporting, not a past client case. The lesson from every persistent infection we have cleaned is the same: the visible file is the easy part. Self rebuilding backdoors and stolen secrets are what bring attackers back weeks later, so a proper cleanup always ends with every key and password replaced.
Written by Ali Yasin Jatoi
Founder of WebCare Studios. Ali has worked with WordPress for more than 10 years, including managing a Pearl Lemon internal fleet of 150+ sites with WP-CLI automation for updates, security cleanup, and malware removal. He has hands on experience across major hosts including Cloudways, A2 Hosting, Hostinger, and Bluehost.
Site down, hacked, or broken checkout gets a senior engineer within 4 hours. No ticket queues, no bots.
Flat quote up front. If we cannot get you back online, you do not pay. Risk sits with us, not you.
We work on a snapshot first and never touch your live database until the fix is verified safe.
Our founder managed 150+ Pearl Lemon internal WordPress sites. The errors you are seeing are ones we have closed hundreds of times.
There is no need if you are on 3.0.124 or later and the site has been cleaned. Removing the plugin does not remove the planted backdoors, so the cleanup matters more than the plugin choice.
No. Rank Math settings live in the database. We clean around them and leave your titles, schema and redirects in place.
Yes. We reply within 8 to 12 hours. Emergency cleanup starts from $249, quoted before we start.
Two fields. Email and your URL. A senior WordPress engineer reads it within minutes and replies on email and WhatsApp with what is wrong and what we will do next.
Real proof and field guides tied to "Rank Math PRO compromised update".
