Rank Math PRO 3.0.123 shipped malware through its own updates

What happened

Attackers got into Rank Math's distribution process and slipped malware into some copies of Rank Math PRO 3.0.123, the paid edition of the popular WordPress SEO plugin. Sites received it the normal way: a manual download or an automatic update from rankmath.com.

The tainted copies went out between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026. Rank Math pulled the files and shipped a clean 3.0.124. Wordfence rated the incident 9.8 out of 10.

The malware can leave behind its own files, rogue admin accounts and scheduled tasks that rebuild the backdoor. Rank Math says any password, database credential or API key the server could read may be exposed.

Who is affected

• Sites running Rank Math PRO that downloaded or updated to 3.0.123 inside the window above.
• Having 3.0.123 installed is not proof by itself. The genuine 3.0.123 came out on October 7, and copies obtained before the window are clean.
• The free Rank Math SEO plugin from WordPress.org was not affected.

What to do

1. Find out when your site received 3.0.123.
2. Before the window: you're not affected. Update to 3.0.124 normally.
3. Inside the window, never activated: delete the plugin folder, install 3.0.124 from your Rank Math account, and run a malware scan.
4. Inside the window and activated: treat the site as compromised. Restore files and database from a backup taken before 20:02 UTC on October 15, then change every password and rotate every key and token the site touches. Updating the plugin alone does not remove what the malware left behind.

Timeline

• Oct 7, 2026: Genuine Rank Math PRO 3.0.123 released.
• Oct 15, 20:02 UTC: Malicious copies start going out.
• Oct 16, 07:12 UTC: Window closes. Rank Math pulls the files and ships 3.0.124.
• Oct 16, 2026: Rank Math publishes its security notice.
• Oct 17, 2026: Wordfence publishes its advisory (CVE-2026-111862, CVSS 9.8).

Sources

• SecurityWeek
• SQ Magazine
• UltimateWB
• IT-Connect