Some Rank Math PRO downloads contained malware. Check your WordPress site

If your WordPress site uses Rank Math SEO PRO, the paid version of the popular SEO plugin, check which version you're on today. Some copies of version 3.0.123 contained malware, and if your site picked one up and switched it on, you need to treat the site as hacked.

The good news is that the window was short, about eleven hours, and most sites won't be affected. The checks below take a few minutes.

What happened

Rank Math published a security notice on 16 October. It says a limited number of users downloaded copies of PRO 3.0.123 that "contained malware that could compromise your website if the plugin was activated".

The affected copies were downloaded between 20:02 UTC on 15 October and 07:12 UTC on 16 October. In UK time, that's from just after 9pm on the Wednesday to just after 8am on the Thursday. Rank Math has removed the bad files and released 3.0.124 as a clean replacement.

Rank Math's notice doesn't say how it happened, and I'm not going to guess. What matters for you is whether your site got a bad copy.

What the malware does

This isn't a flaw someone might exploit one day. According to Rank Math, it plants a backdoor that can rebuild itself if you only remove part of it, and the attacker may have added admin accounts, scheduled tasks or changes at server level.

That's why Rank Math's recovery steps include changing every password and key the site holds. If your site sends email through a paid service, takes card payments or talks to a CRM, those keys count too.

Does it affect you?

Rank Math splits people into three groups:

• You downloaded 3.0.123 in the window but never installed it. Rank Math says that on its own gives no indication of compromise. Delete the file.
• You installed it but never activated it. Delete the plugin files, install 3.0.124 from your Rank Math account, and run a security scan.
• You activated it. Treat the site as compromised and work through the recovery below.

Rank Math says it knows who downloaded the affected version and has already notified some users. Don't wait for an email, though. If your site updates automatically, or someone else looks after it, you may not know when it happened.

To check, log in to WordPress, go to Plugins and look at the Rank Math SEO PRO version number. If you have shell access, wp plugin list shows every plugin and version in one go. If you're on 3.0.123, find out when it was installed. Your backups, hosting control panel or update logs might tell you. Copies downloaded outside the window aren't affected.

What to look for

Rank Math lists these signs that a site has been hit:

• Options in the database called _uf6qdn2hmm, t8krdk990phb or _np5pvf754c.
• A file called wp-includes/class-wp-cache-util.php. That isn't a real WordPress file.
• Admin users whose names start with wpsupport_, or with email addresses ending in @wp-mail.net.
• PHP code inside .cache files, in your uploads folder or in wp-content/mu-plugins/.
• A scheduled task on the server containing #ms6v46.
• Connections from your server to rank1cdn.com.

If you have WP-CLI, this checks the database options in one go:

wp option list --search="_uf6qdn2hmm"
wp option list --search="t8krdk990phb"
wp option list --search="_np5pvf754c"

And this checks whether your WordPress core files have been changed:

wp core verify-checksums

Not finding any of these doesn't prove the site is clean. It just means you haven't found anything.

What to do this week

1. If you're on 3.0.123, update to 3.0.124. Download it by logging in at rankmath.com yourself. Rank Math says it will never send login or download links by email, so ignore any email that offers one.

2. If you activated a bad copy, restore from a backup. Rank Math's preferred fix is restoring the site and database from a backup taken before 20:02 UTC on 15 October. That's the cleanest way back.

3. If you have no clean backup, clean up in the right order. Rank Math's notice sets out the steps. First stop the backdoor rebuilding itself: delete the whole rank-math-pro folder (switching the plugin off isn't enough), remove the three database options and block the domain if you can. Then hunt down the other changes, and reinstall WordPress, plugins and themes from trusted copies.

4. Change every password and key. WordPress logins, the database password, WordPress security keys and salts, payment and email service keys, hosting control panel, FTP, SFTP and SSH. All of them. A clean site is no good if the attacker still has the keys.

5. Keep watching. If any of the files you deleted come back, the cleanup isn't finished.

The bigger point

Keeping plugins updated is still the right advice. This is the awkward case where the update itself was the problem. What saves you isn't avoiding updates. It's a backup from before the problem, and knowing when each update went on.

If you think your site got a bad copy and you'd rather not do the cleanup yourself, that's what my breach first response is for. I'll contain it, find out what changed, clean it up and write down what I did.