Rank Math has disclosed that some downloads of its Rank Math PRO WordPress SEO plugin contained malware, potentially compromising websites that installed and activated the affected files.
The incident involved version 3.0.123 of the premium plugin, distributed during a limited period between October 15, 2026, at 20:02 UTC and October 16 at 07:12 UTC. Rank Math has since removed the affected files and released a clean replacement, version 3.0.124.
According to the company’s security advisory, the malicious code could establish persistent access to an infected website, allowing attackers to maintain control even after the original plugin files have been replaced.
The malware can recreate a hidden backdoor when someone visits an affected website. Attackers may also have left behind unauthorized administrator accounts, additional malicious files or scheduled tasks, making a routine plugin update insufficient to fully secure a compromised installation.
WordPress security company Wordfence also warned that compromised sites could have exposed sensitive information, including WordPress credentials, database passwords and API keys.
The issue does not necessarily affect every website running version 3.0.123. Rank Math says the incident was limited to copies obtained during the identified distribution window, and the potential consequences depend on whether those files were installed and activated.
Websites that activated an affected copy should be treated as compromised, according to the company. Rank Math recommends restoring the website and database from a clean backup created before the incident, scanning for malicious activity and replacing potentially exposed credentials before installing version 3.0.124.
Site administrators who downloaded the affected version but never activated it are not considered compromised based on the incident alone, but should remove the affected files, install the clean release and run a security scan.
Leave a Reply