Between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026, copies of Rank Math PRO downloaded from the vendor’s site or delivered as updates contained malware. That window lasted about 11 hours. The delivery route was the official one, and the version number, 3.0.123, was the same one the vendor had shipped without problems on October 7.

Rank Math’s security notice says any site that installed and activated a copy from that window should be treated as compromised. For MSPs that look after client WordPress sites, the work now is to find out which sites took the update during those hours, and what the malware did once it was there.

What makes an affected site compromised

The notice describes malware that establishes persistent access, communicates with a domain called rank1cdn[.]com and recreates a hidden backdoor whenever someone visits the site. Its indicators include hidden PHP files in the must-use plugins folder and in other plugins and themes, administrator accounts with usernames beginning wpsupport_, a fake WordPress core file and .htaccess rules that let .cache files run as PHP.

It also lists server-level changes outside WordPress, including cron entries tagged #ms6v46 and changes to SSH authorized_keys files. The vendor tells owners to assume that every password, database credential, API key and other secret the site had access to has been exposed.

Why updating to a clean build does not remove it

Rank Math has released a clean version, 3.0.124. Installing it replaces the plugin. It leaves the files, accounts, scheduled tasks and server changes the malware placed elsewhere exactly where they are. BleepingComputer reports that the vendor’s guidance is explicit: deactivating or updating the plugin after a compromise will not remove the threat.

The vendor’s recommended route is a restore from a backup taken before 20:02 UTC on October 15, followed by changing every credential, with the clean version installed last. Where no clean backup exists, the manual cleanup starts by deleting the whole plugin folder and three database entries before anything else, because the malware rebuilds its backdoor on page visits.

What this means in practice is that a plugin list showing 3.0.124 tells you nothing on its own. As The Hacker News points out, the version number does not show whether a copy is affected either, because 3.0.123 existed in a clean form for 8 days before the window opened. The question to ask for each site is when the plugin was downloaded, and whether it was activated.

Why the web server rarely tells you

Web servers are often the one machine in a client estate without an endpoint agent. On shared or managed hosting there is nowhere to install one, and the MSP often holds nothing more than WordPress admin access. The backdoor here is PHP running as part of the site, so on many client sites there is no agent to raise an alert in the first place.

That leaves the evidence the malware has to leave outside the server: network connections going out, accounts appearing and credentials being used somewhere new.

The 3 signals to watch

Calls to brand-new domains. The Hacker News reports that registry records show rank1cdn[.]com was registered at 19:31 UTC on October 14, about a day before the window opened. A web server that starts talking to a domain registered within the last few days is worth an alert, whichever plugin is responsible.

New administrator accounts. The vendor lists usernames beginning wpsupport_ and email addresses ending @wp-mail[.]net. More generally, an administrator account created outside a change request, on a site where admins rarely change, should be escalated the same day.

Cloud keys used from new places. The vendor tells owners to assume that API keys and other secrets the site had access to were exposed. BleepingComputer found a related malware sample with code to steal AWS, Cloudflare, Google Cloud and Azure credentials and SSH keys, although it was unable to confirm that sample was delivered through the plugin. If a key stored on a WordPress server is suddenly used from an address it has never used, treat it as stolen.

What to do this week

1. Find every client site running Rank Math PRO, and establish when 3.0.123 was downloaded or updated and whether it was activated.

2. For sites that activated a copy from the window, follow the vendor’s recovery steps, restoring from a backup taken before October 15 where one exists.

3. Rotate everything the site had access to: WordPress passwords, database credentials, keys and salts, payment and email credentials, API keys, hosting and SSH access, and secrets held in environment variables.

4. Block outbound connections to rank1cdn[.]com at the host or firewall, as the vendor recommends.

5. Set alerts for web servers calling newly registered domains, new WordPress administrator accounts and cloud keys used from unfamiliar locations.

Steps 1 and 4 are short pieces of work. Steps 2 and 3 take longer per site, because credential rotation touches every service the site connects to. Step 5 carries over to the next incident, and The Hacker News counts this as at least the third time this year that a premium WordPress plugin’s own update channel has delivered backdoored builds.

The outcome: spotted on the network side

The pattern you will see is that the web server itself says little. The firewall sees the call to a domain registered the day before. The WordPress and identity logs show the new administrator. The cloud provider shows a key used from somewhere new. Put those together and the MSP finds the compromise from the outside, without an agent on the server.

Start with the inventory of Rank Math PRO sites this week. Then put the 3 alerts in place for every client web server, so the next one is caught by the network data rather than by the client.

enhanced.io correlates network, identity and cloud signals across client environments, and the SOC detects and escalates activity like this to the MSP’s team.

Key takeaways

• Rank Math PRO copies downloaded or updated between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026, carried malware.

• Any site that activated an affected copy should be treated as compromised, even after installing the clean 3.0.124.

• The vendor’s preferred recovery is a restore from a pre-incident backup, followed by rotating every credential the site had access to.

• Web servers rarely run an agent, so the evidence sits on the network, identity and cloud side.

• Watch for calls to brand-new domains, new admin accounts and cloud keys used from new places.

About enhanced.io

enhanced.io is a channel-only Open XDR SOCaaS built exclusively for MSPs, with 400+ integrations across endpoint, network, cloud, identity and IoT/OT. We work only through MSP partners and never sell direct to end clients. To talk about how enhanced.io fits your stack, book a partnership conversation with Hannah Lloyd.