Rank Math Recovery Starts With the Download Window
For a website that ran a compromised Rank Math PRO package, recovery involves the site, its database and the credentials it could reach. Installing the clean replacement changes the plugin files. It does not establish what the earlier package already changed elsewhere, which accounts were created or which secrets may have been exposed.
Rank Math’s incident notice limits the affected downloads and updates to PRO 3.0.123 obtained between 20:02 UTC on 15 October 2026 and 07:12 UTC on 16 October. The company removed those files and released 3.0.124 as the clean replacement. The free edition distributed through WordPress.org is outside the malware incident’s stated scope.
Establish the package’s history
The vendor distinguishes three situations. If an affected copy was installed and activated, treat the website as compromised. If it was installed but never activated, remove the affected files, obtain the clean replacement and run a precautionary security scan. Downloading an archive without installing or activating it does not, by itself, establish that this incident compromised the website.
Reconcile download records, installation history and any vendor notification before closing that decision. A site showing another version today can still have run the affected copy earlier. Conversely, the version number alone does not identify a malicious download. Where the history is uncertain, Rank Math directs owners to its support team rather than offering an automatic all-clear.
Wordfence’s CVE-2026-111862 record, published on 19 October, preserves that subset and time-window boundary and assigns a Critical CVSS 3.1 score of 9.8. The identifier’s publication date is separate from the October distribution incident. Neither the score nor a later record entry establishes how many websites were compromised.
Choose recovery before declaring the update complete
Rank Math recommends restoring both the website files and database from a clean backup made before the affected window. Its sequence then includes a security scan, replacement of potentially exposed credentials and installation of the clean plugin. A restored database matters because persistence can reside beyond an individual plugin directory.
Where a suitable backup is unavailable, the vendor provides an ordered manual-cleanup procedure and recommends help from the hosting provider or a qualified security professional. The mechanism that recreates the backdoor needs attention before other malicious files are removed. Otherwise a page visit can recreate something the investigator has just deleted.
That first stage covers the entire affected plugin folder, the malicious entries identified in the WordPress options table and, where the host permits it, blocking the published malicious destination. The notice’s three option names are _uf6qdn2hmm, t8krdk990phb and _np5pvf754c. Use the vendor’s current procedure for the exact investigation and removal order. An indicator match requires investigation; absence of those few strings is insufficient evidence of a clean site.
The wider review includes hidden PHP in must-use plugins, other plugins and themes; unfamiliar administrator accounts; a fake core file; rules that execute cache files as PHP; uploaded PHP; and scheduled tasks. Host-level access also matters: the notice names SSH authorised keys, other users’ scheduled jobs, running processes and writable locations outside the website directory. A shared-hosting customer may need the provider to inspect areas they cannot access.
Recover identities and verify the running site
Restoring an earlier backup does not revoke a credential that may already have left the server. Rank Math tells affected owners to replace reachable passwords, database credentials, WordPress security keys and salts, API and service credentials, and hosting or server access credentials. Payment and email integrations belong in that review, alongside environment variables and administrator two-factor authentication.
After the applicable recovery, verify the website against trusted material and monitor its behaviour. The vendor includes core and plugin checksum checks, but notes that checksums may be unavailable for premium plugins. Compare those with a clean official copy instead. Watch outgoing connections, unusual activity and whether removed files return. Returning files call for renewed investigation, rather than another declaration that the plugin has been updated.
The separation between accepting a replacement artifact and recovering earlier access also appears in BlackTree’s separate LiteLLM supply-chain review. Its publishing and execution mechanisms differ from this incident. The common operational question is whether the environment and its identities have been recovered as well as the software replaced.
Keep sample findings and account disruption in scope
BleepingComputer’s own sample examination, published on 19 October, found PHP code sharing indicators from Rank Math’s notice and capable of command execution and seeking cloud credentials. The newsroom could not confirm that this sample was distributed through the compromised plugin. Its findings therefore cannot identify the payload that ran on every affected website or prove that every reachable secret was stolen.
A separate consequence affected some free Rank Math accounts registered during 13–16 October. The vendor says its system refresh removed those accounts while the website plugin, SEO settings, metadata and content continued working. Account access, connected Google reporting, rank tracking and Rank Math AI features require the affected account to be recreated and the website reconnected. This account disruption does not extend the malware claim to the free WordPress.org plugin.
For recovery downloads and account access, navigate directly to the official vendor site. Rank Math says it will not email login or download links; treat unsolicited messages containing those links as suspicious. Retain the affected package history, the recovery work completed and the checks still outstanding. BlackTree has reviewed the public evidence and has not tested a reader’s installation, run the malware or verified any organisation’s incident closure.
