Science & Tech · Cybersecurity · 1 day ago
Malicious Rank Math PRO downloads could leave WordPress sites exposed
Some Rank Math PRO downloads contained malware after the WordPress plugin was compromised in a supply chain attack.
The affected downloads were version 3.0.123 obtained between October 15 at 20:02 UTC and October 16 at 07:12 UTC.
Sites where the plugin was activated should be treated as compromised, even if it has since been updated.
Rank Math PRO is the paid version of a WordPress search-engine optimization plugin; the free version was not affected.
The malware can create hidden backdoors, maintain access to websites, and expose passwords, database credentials and API keys.
Rank Math has released a clean version, 3.0.124, but installing it alone does not remove malware or changes already left on a site.
Affected site owners should restore a clean backup or follow cleanup steps, then change passwords and other credentials and install the clean plugin.
Malicious Rank Math PRO version 3.0.123 packages could expose WordPress sites to backdoors if activated.
The affected downloads and updates were available from October 15, 2026, at 20:02 UTC to October 16 at 07:12 UTC.
Rank Math removed the affected files and released clean version 3.0.124.
Sites where the compromised plugin was installed and activated during the window should be treated as compromised.
The malware could maintain access, recreate hidden backdoors, and expose credentials, API keys, and other secrets.
- Who
- Users who downloaded or updated Rank Math PRO version 3.0.123 during the affected window may be at risk.
- What
- Malicious plugin files could install malware and hidden backdoors on sites if activated.
- When
- October 15, 2026, at 20:02 UTC to October 16 at 07:12 UTC.
- Where
- WordPress websites using the paid Rank Math PRO plugin.
- Why
- The plugin was compromised in a supply-chain attack. The sources do not state how the attack was carried out.
This story does not have two clearly opposing sides.
The period when compromised version 3.0.123 downloads and updates began.
The reported window for receiving compromised files ended.
Rank Math published a security notice about the affected copies.
Wordfence published an advisory warning that installing the clean plugin does not remove malware already placed elsewhere.
- Affected version
- Rank Math PRO 3.0.123
- Clean version
- Rank Math PRO 3.0.124
- Affected window
- October 15, 2026, 20:02 UTC–October 16, 2026, 07:12 UTC
- Malware domain
- rank1cdn[.]com
- Free plugin
- Rank Math SEO on WordPress.org was not affected
4 sources
What people are saying
The affected plugin files contained malware that could compromise your website if the plugin was activated
We immediately removed the affected files and released a clean version, Rank Math PRO v3.0.124.