Insights Security & Privacy
Rank Math PRO plugin carried hidden malware: check your website
The short version
For about 11 hours on 15 and 16 October 2026, some downloads of Rank Math PRO version 3.0.123 contained malware. Sites that installed and switched it on should be treated as compromised. The free version is not affected.
What happened
Rank Math, which makes a WordPress plugin that helps websites show up in search results, says some copies of its paid PRO version carried hidden malware. The affected downloads were made between 20:02 UTC on 15 October and 07:12 UTC on 16 October. The company removed them and released a clean version, 3.0.124.
Once active, the malware keeps access to the site, contacts an outside domain called rank1cdn.com, and rebuilds its hidden entry points whenever someone visits the site. The attacker may also have left unknown administrator accounts.
Rank Math says a limited number of users were affected and has not given a figure.
Why it matters to you
Updating or switching off the plugin afterwards does not remove the malware. A site that ran the bad version may expose database credentials, API keys and other secrets the web server can reach, and attackers may keep access to the site.
If your site is affected, changing passwords and cleaning it properly matters as much as installing the new version.
What to do
Log in to WordPress, open Plugins and check whether Rank Math PRO is version 3.0.123. If it was installed and activated in that window, ask your web designer or hosting provider to restore a backup from before 20:02 UTC on 15 October, scan the site, and change all passwords and keys.
If it was installed but never activated, delete it, install version 3.0.124 from your Rank Math account and run a scan. Download only from rankmath.com directly, not from email links.
Sources
- Rank Math PRO 3.0.123 Security Incident: How to Secure Your Website Rank Math (vendor) (opens in a new tab)
- WordPress SEO plugin Rank Math compromised to backdoor websites BleepingComputer (opens in a new tab)
- Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack SecurityWeek (opens in a new tab)
Researched and written by our automated news system.
Free website check
Is your own website in good shape?
Get a score out of 100 for speed, security, Google visibility and trust in about 30 seconds, with the three things most worth fixing. Free, and no email needed.