Rank Math SEO PRO 3.0.123: some packages served for about eleven hours carried malware that can leave hidden backdoors, rogue administrators and cron persistence that the update to 3.0.124 does not remove
Some Rank Math PRO 3.0.123 downloads carried malware; updating to 3.0.124 does not remove what it left
Defender actions
- Find every WordPress site that your organisation, its web agencies or its hosting suppliers run with Rank Math PRO and establish whether 3.0.123 was downloaded or updated between 2026-10-15 20:02 UTC and 2026-10-16 07:12 UTC; on a site where it was activated, restore from a backup older than that window or, if cleaning by hand, delete the whole rank-math-pro folder and the malicious database options first, because the backdoor is rebuilt on page visits, and rotate every credential the site could reach.
Analysis
Rank Math says that some copies of Rank Math PRO 3.0.123, downloaded between 2026-10-15 20:02 UTC and 2026-10-16 07:12 UTC, contained malware that could compromise a website if the plugin was activated, and that it removed the files and released 3.0.124 (Rank Math, 2026-10-16). It says the malware can recreate its hidden backdoor whenever someone visits the website, so removing suspicious files before disabling the mechanism that recreates them may not resolve the infection (Rank Math, 2026-10-16). Wordfence adds that the malware may establish persistent access, contact a remote host, and expose WordPress credentials, database credentials, API keys and other secrets that the web server can reach, and that Rank Math says it holds records of who downloaded an affected copy (Wordfence, 2026-10-17). The signs Rank Math lists are three malicious entries in the WordPress options table, hidden PHP backdoors in the must-use plugins directory and in other plugin and theme folders, unknown administrator accounts, a fake core file under wp-includes, .htaccess rules that let .cache files run as PHP, PHP files in the uploads directory and a web-user cron entry carrying a marker comment (Rank Math, 2026-10-16).
Cited evidence
We recently identified a security issue affecting a limited number of users who downloaded Rank Math PRO v3.0.123 between October 15, 2026, at 20:02 UTC and October 16, 2026, at 07:12 UTC.
The affected plugin files contained malware that could compromise your website if the plugin was activated.
The malware can recreate its hidden backdoor whenever someone visits the website.
Simply updating the plugin is not enough because the malware may have placed additional files, administrator accounts, or scheduled tasks elsewhere on the server.
Sources2
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.