Downloads and updates of Rank Math PRO carried malware for just over eleven hours. Copies fetched from rankmath.com or pushed as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 were poisoned, the plugin maker said in a notice the following day.
Any site that installed and activated one of those builds should be treated as compromised. The malware can regenerate its hidden backdoor each time someone loads a page.
The version number will not help you
The changelog dates 3.0.123 to October 7, more than a week before the window opened, so the release you see tells you nothing. Only the install or update time matters. Rank Math split sites into three groups: installed and activated during the window, treat as breached even after upgrading; installed but never activated, delete the files; downloaded only, no evidence of compromise.
Version 3.0.124 is clean, but installing it replaces plugin files without removing backdoors, administrator accounts or scheduled tasks planted elsewhere.
The cleanup order matters
Wordfence and Rank Math both say restore from a pre-incident backup first. Without one, three steps come before any hunting: delete the entire rank-math-pro folder, drop specific database rows from wp_options, and block outbound traffic to rank1cdn[.]com.
Then look for a class-wp-cache-util.php file that is not WordPress core, administrator names starting wpsupport_, and .htaccess rules letting .cache files execute as PHP. Check SSH authorized_keys and other users’ crontabs too.
Assume credentials are gone
Because the persistence mechanism survives, every secret on the host should be rotated: WordPress logins, database credentials, salts, API keys and hosting access. Wordfence warns that finding nothing is not proof of a clean site.
