Rank Math PRO downloads and updates carried malware, vendor says

Past-week coverage · Original source published 2026-10-19.

Rank Math has warned that copies of Rank Math PRO, the paid version of its WordPress SEO plugin, contained malware. In a security notice published on October 16, the company said the affected copies were those downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16.

The vendor's guidance is blunt: any site that installed and activated one of those copies should be treated as compromised. Reporting on the notice describes the payload as a self-restoring backdoor, meaning it is built to come back after removal. The retained source does not detail how the malicious code was introduced, what the backdoor does once active, or how many sites received it.

Why it matters

WordPress plugins run with broad access to a site's files and database, and a compromised SEO plugin sits on the public-facing side of a site. A backdoor that survives cleanup attempts is harder to close out than a one-off infection, because deleting the obvious file may not be enough.

What site owners should do

• Check whether Rank Math PRO was installed or updated during the stated window.
• If it was, treat the site as compromised rather than assuming a clean scan settles it.
• Follow the vendor's notice for remediation steps, and review the site for persistence rather than only removing the plugin.
• Rotate credentials and review administrator accounts, since a backdoor can be used to regain access.

The source does not say whether a clean version has been published or how the vendor recommends verifying an installation. Site owners should confirm current status with Rank Math directly before assuming an install is safe.