Rank Math PRO WordPress plugin hit by supply chain attack

Past-week coverage · Original source published 2026-10-19.

Rank Math says its PRO WordPress SEO plugin was compromised in a supply chain attack, and that some version 3.0.123 packages contained malware that could let attackers take over a website if the plugin was activated.

The company says anyone who downloaded or updated to the affected version between October 15, 2026, at 20:02 UTC and October 16, 2026, at 07:12 UTC might have been infected. It says it removed the affected files and released a clean version, Rank Math PRO v3.0.124.

Why the cleanup is hard

According to Rank Math, the malware may give attackers persistent access and could expose credentials, API keys and other secrets. It may recreate a hidden backdoor on each page visit, which the company says can make manual cleanup difficult.

Rank Math's guidance is to treat any site that installed and activated the affected version during that window as compromised and restore it from a clean backup made before the incident. For sites without such a backup, it lists steps including deleting the plugin folder, removing a malicious database entry, blocking the attacker's domain, and finding suspicious PHP files and unknown administrator accounts.

The malware may also plant fake WordPress core files, alter .htaccess rules so .cache files run as PHP, and schedule tasks. Rank Math says admins should also check outside the WordPress install, including SSH authorized_keys files and other users' crontabs. After confirming a site is clean, it advises changing all passwords and installing the clean plugin version.