Rank Math says attackers slipped malware into some downloads of its paid WordPress SEO plugin, putting websites that installed the tainted update at risk of takeover. The compromised packages were Rank Math PRO version 3.0.123 distributed between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC; the vendor released a clean 3.0.124 build and warned the malware could create persistent backdoors, alter .htaccess, drop malicious PHP disguised as .cache files, create admin accounts, and expose credentials and API keys.
Why it matters: Any site that installed and activated the affected plugin during the compromise window should be treated as breached, not just vulnerable. Admins should restore from a clean backup if possible, thoroughly hunt for persistence, rotate passwords and keys, and install the clean version immediately.
Bill Toulas
2026.10.19
99% relevant
This article covers the same Rank Math PRO supply-chain compromise and adds concrete details on the affected download window, malware behavior, command-and-control domain, persistence mechanisms, exposed secrets, and cleanup steps.
info@thehackernews.com (The Hacker News)
2026.10.19
99% relevant
This article appears to cover the same underlying event: the compromise of Rank Math PRO update distribution that delivered a backdoored plugin version with persistent, self-restoring access on affected WordPress sites.
Ionut Arghire
2026.10.19
100% relevant
This article appears to be the initial report of the specific Rank Math PRO package compromise and the vendor's remediation guidance.
← Back to all stories