Rank Math PRO hijacked to backdoor WordPress sites and F5 rushes NGINX patches: what to check today on the website of your Mexico operation

On October 19, 2026, it was confirmed that someone compromised Rank Math PRO, one of the most widely used SEO plugins for WordPress. Through it, attackers planted a backdoor that reinstalls itself on affected sites, as The Hacker News reported.

The same day, F5 shipped out-of-band patches for critical NGINX flaws. NGINX is the web server behind many hosting providers.

Why this matters from abroad: the Spanish-language site of your Mexico operation was often built by a local agency, sits on a local hosting plan and never shows up in the IT inventory at headquarters.

Why this attack is different

Most WordPress compromises start with an abandoned plugin or a cracked theme. Not this one. The code came from a paid plugin your agency installed and updated by the book.

That is a supply-chain attack: instead of hitting you, attackers hit your vendor and reach all of its customers at once. We saw a similar pattern with the Brevo ClickFix scripts.

How to tell if your Mexico site runs Rank Math PRO

Log in to WordPress (yoursite.mx/wp-admin), open Plugins and look for “Rank Math SEO PRO”. The version number sits right next to the name.

Rank Math comes in a free and a PRO edition; the reports point to PRO. Compare your version with the affected and clean versions listed by the vendor and in BleepingComputer’s coverage.

If nobody at your company has admin access to the Mexico site, that is red flag number one. Ask the agency today for an admin account tied to a company email.

Updating will not remove a self-restoring backdoor

A backdoor is a hidden way in that the attacker leaves to come back whenever they like. Self-restoring means something on the server recreates it after you delete it.

In our experience, those copies hide where nobody looks. This is what we check first:

Where to look	What to look for
Users › Administrators	Accounts nobody on your team recognizes
wp-content/mu-plugins folder	Must-use plugins: they always load and do not appear in the normal list
Uploads folder	.php files; it should only hold images and documents
Scheduled tasks (WP-Cron)	Odd task names that run every few minutes
wp-config.php and .htaccess	Recent lines nobody asked for

Before deleting anything, take a full backup of files and database as evidence. The safest cleanup is usually reinstalling WordPress and every plugin from official sources.

When to rotate passwords and keys

Order matters. Change passwords while the backdoor is still in, and the intruder sees the new ones.

1. Clean the site first.
2. Then change passwords for every admin, the hosting or cPanel account, FTP and the database.
3. Regenerate the WordPress security keys (the “salts” in wp-config.php that sign login sessions). That logs everyone out, intruder included.
4. Review what else was connected: Search Console, Analytics, the contact form, the CRM integration your sales team uses.

NGINX: get the hosting provider to confirm the patch in writing

NGINX is the software that receives visitors and serves your pages. On shared hosting, the provider installs the patch, not you.

Send them a short email today asking whether F5’s October 19 NGINX patches are applied. Keep the written answer. If the Mexico site runs on its own VPS, the update is on you or whoever manages it.

Fewer plugins, fewer doors

Our take: every plugin is one more vendor holding keys to your site. Many local marketing sites carry more plugins than anyone remembers installing.

The real question is who maintains the Mexico site. If the answer is “the agency that built it years ago”, that is your risk. An IT support plan can cover the website along with everything else.

Let’s talk

What about your Mexico operation?

At ProcessBi we review and clean WordPress sites, keep them patched and, when it makes sense, build lightweight sites with fewer plugins. We work in English and invoice in MXN or USD.

Book a free review of your site — we reply the same business day.