Users downloaded malicious versions of Rank Math PRO last week, after the WordPress SEO plugin was compromised in a supply chain attack. Some version 3.0.123 packages contained malware that could allow attackers to take over websites if the plugin was activated, based on information published by Security Week.
The compromised plugin version, 3.0.123, was available between Oct. 15, 2026, at 20:02 UTC and Oct. 16, 2026, at 07:12 UTC. Rank Math has since released a clean version, 3.0.124. Websites that activated the infected version are considered compromised and should be restored from a backup. The malware can provide persistent access, expose credentials and API keys, and create hidden backdoors. Cleanup may involve deleting the plugin, removing malicious database entries, blocking the attacker's domain, and searching for suspicious files and accounts. Attackers could also modify core files, .htaccess, and deploy fake WordPress core files. Site administrators should also check for unauthorized SSH keys, crontabs, and suspicious processes outside the WordPress installation. After cleaning, all passwords should be changed, and a clean version of Rank Math PRO installed.
Source: Security Week
