Rank Math PRO 3.0.123 Spread Malware Through Some Updates

Rank Math PRO malware reached some downloads and updates of the paid WordPress plugin between October 15, 2026, 20:02 UTC and October 16, 2026, 07:12 UTC. Rank Math confirmed the incident and released the clean version 3.0.124. Operators who obtained and activated the malicious package during this interval should consider their website compromised.

The incident does not affect the free Rank Math SEO plugin distributed through WordPress.org. The mere presence of version 3.0.123 on a website also does not mean the site was hacked: the decisive factor is when the package was downloaded or updated.

Rank Math PRO malware: what it could have caused

According to Rank Math’s notice, activating the affected package could have introduced a hidden backdoor to the website. The malware could have restored itself after a page visit, complicating removal through a simple plugin update.

The vendor also warns of other possible signs of compromise. These include malicious or modified files, created administrator accounts, scheduled tasks, and server changes. With an active malicious package, switching to the patched version 3.0.124 therefore may not remove all consequences of the previous infection.

The risk also extends to data accessible to the compromised web server. This may include passwords, database credentials, and API keys stored in the configuration or available to the application.

What WordPress administrators should do

Administrators should first verify when Rank Math PRO 3.0.123 was obtained or updated. If this occurred during the affected interval and the plugin was activated, Rank Math recommends restoring the website and database from a backup created before October 15, 2026, 20:02 UTC.

If such a backup is unavailable, thorough manual cleaning according to the vendor’s procedure is required. The review should not be limited to the plugin itself, since the backdoor could have persisted outside its files.

• install the clean version of Rank Math PRO 3.0.124,
• scan the website and server for unknown files, administrator accounts, and scheduled tasks,
• check for configuration changes and other signs of unauthorized access,
• change passwords and rotate secrets, including database credentials and API keys that may have been accessible to the server.

Undisclosed attack vector and incident scope

Rank Math removed the malicious files from distribution, but has not publicly disclosed the initial attack vector, the attacker’s identity, or the number of potentially affected websites. It is also unconfirmed how many compromised packages were activated and whether websites that may subsequently have been abused were actually hacked.

The case is a confirmed compromise of the distribution channel for the paid plugin. For administrators, distinguishing between the version number and the time it was obtained is essential: version 3.0.123 outside the specified window is not, by itself, an indicator of compromise.

Further information may come from any disclosure of the cause of the breach, the number of affected customers, or cryptographic hashes of the malicious packages. Notifications may also be expected regarding confirmed abuse of compromised websites or attribution of the attack to a specific group.

Verified and updated: October 20, 2026, 06:25