Rank Math PRO update was hacked with malware. What WordPress site owners should do now
Copies of Rank Math PRO version 3.0.123 downloaded on October 15-16 contained a hidden backdoor. The free version is not affected.
If you run a WordPress website with the paid Rank Math PRO SEO plugin, check your version today. Rank Math has confirmed that some copies of version 3.0.123 contained malware, after attackers compromised the way the update was distributed.
Rank Math is one of the most popular SEO plugins for WordPress, so this is a serious supply-chain attack: a trusted update was turned into a weapon.
Who is affected?
According to Rank Math, the problem affects people who downloaded Rank Math PRO v3.0.123 between:
- October 15, 2026 at 20:02 UTC and
- October 16, 2026 at 07:12 UTC
The free version of Rank Math from WordPress.org is not affected and needs no action for site security.
What the malware does
Rank Math says the infected files contained a hidden backdoor that could give attackers ongoing access to a website once the plugin was activated. The backdoor could rebuild itself when the site was visited. Attackers could also add changes such as:
- Hidden administrator accounts
- A fake WordPress core file
- Changed
.htaccessrules - Malicious scheduled tasks (cron jobs)
What to do, step by step
1. If you activated version 3.0.123
Treat the site as compromised. Rank Math recommends:
- Restore your website and database from a backup made before October 15, 2026 at 20:02 UTC.
- Scan the site with a security plugin or service.
- Change all passwords and keys: WordPress users, hosting, database, and WordPress security keys.
- Install the clean version 3.0.124.
Without a clean backup, follow Rank Math’s manual clean-up guide. Note that simply deactivating the plugin is not enough, and the rank-math-pro folder must be deleted.
2. If you installed but never activated it
Delete the affected files, install 3.0.124 and run a security scan to be safe.
3. If you downloaded it but never installed it
Rank Math says there is no sign your site was compromised by this incident. Delete the file and download the clean version.
Only download plugin updates from the official website after logging in. Never trust download links sent by email.
Why supply-chain attacks are so dangerous
Most WordPress security advice says “keep your plugins updated”. In this case, the update itself was the problem. Attackers target popular tools because one infected update can reach thousands of websites at once.
Lessons for every website owner
- Keep daily backups stored away from your website, so you can roll back quickly.
- Use as few plugins as possible, and only from trusted developers.
- Check your admin users list regularly for accounts you don’t recognise.
- Use a security scanner that alerts you to changed core files.
