---
title: Hunt: Rank Math PRO 3.0.123 backdoor (rank1cdn[.]com, wp_options keys _uf6qdn2hmm / t8krdk990phb / _np5pvf754c) | ctxsec
url: https://ctxsec.com/items/hunt-rank-math-pro-backdoor
description: ""
status: "hunt idea (vendor IOCs via Wordfence)"
published: 2026-10-17
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-rank-math-pro-backdoor.md)

hunt idea (vendor IOCs via Wordfence)

2026-10-17

### Hunt: Rank Math PRO 3.0.123 backdoor (rank1cdn[.]com, wp_options keys _uf6qdn2hmm / t8krdk990phb / _np5pvf754c)

Across WordPress fleets and hosting: (1) egress/DNS to rank1cdn[.]com; (2) wp_options rows named _uf6qdn2hmm, t8krdk990phb or _np5pvf754c; (3) admin users created since Oct 15; (4) PHP-executable .cache files, a fake WordPress core file, hidden PHP backdoors and a system cron marker (per Rank Math's IOC list); (5) plugin update logs showing 3.0.123 installed in the 20:02 UTC Oct 15 – 07:12 UTC Oct 16 window. Cleanup order matters: delete the whole rank-math-pro folder and the three option rows and block rank1cdn first, or the backdoor regenerates.

Sources: [Wordfence PSA (CVE-2026-111862)](https://www.wordfence.com/blog/2026/10/rank-math-seo-pro-3-0-123-malware/)