--- schema: 1 kind: incident title: "Rank Math SEO PRO 3.0.123: some packages served for about eleven hours carried malware that can leave hidden backdoors, rogue administrators and cron persistence that the update to 3.0.124 does not remove" headline: "Some Rank Math PRO 3.0.123 downloads carried malware; updating to 3.0.124 does not remove what it left" summary: > Rank Math says some copies of its WordPress plugin Rank Math PRO 3.0.123, downloaded or updated between 2026-10-15 20:02 UTC and 2026-10-16 07:12 UTC, contained malware that could compromise a site once the plugin is activated, and it released 3.0.124 as the clean build. The malware can recreate a hidden backdoor on page visits and may leave administrator accounts, scheduled tasks and files outside the plugin, so an affected site needs the plugin folder and persistence removed in a set order, a restore or cleanup, and rotation of every credential the site could reach; how the vendor's distribution was compromised and who is behind it are not disclosed. discovered_at: "2026-10-18T03:31:00Z" updated_at: null event_date: "2026-10-16" run_id: 2026-10-18T0256Z-intel priority: notable immediate_action: null tags: [supply-chain, patch-available] regions: [global] sectors: [technology] entities: ["incident:rank-math-seo-pro-3-0-123-supply-chain-2026-10", "product:rank-math-seo-pro"] techniques: [T1195.002, T1505.003, T1136.001, T1053.003, T1552.001] affected_products: ["Rank Math SEO PRO"] cves: [] sources: - url: "https://rankmath.com/kb/pro-3-0-123-security-incident/" publisher: "Rank Math" date: "2026-10-16" role: primary - url: "https://www.wordfence.com/blog/2026/10/rank-math-seo-pro-3-0-123-malware/" publisher: "Wordfence" date: "2026-10-17" role: corroborating closed_sources: [] evidence: - quote: "We recently identified a security issue affecting a limited number of users who downloaded Rank Math PRO v3.0.123 between October 15, 2026, at 20:02 UTC and October 16, 2026, at 07:12 UTC." publisher: "Rank Math" source_url: "https://rankmath.com/kb/pro-3-0-123-security-incident/" - quote: "The affected plugin files contained malware that could compromise your website if the plugin was activated." publisher: "Rank Math" source_url: "https://rankmath.com/kb/pro-3-0-123-security-incident/" - quote: "The malware can recreate its hidden backdoor whenever someone visits the website." publisher: "Rank Math" source_url: "https://rankmath.com/kb/pro-3-0-123-security-incident/" - quote: "Simply updating the plugin is not enough because the malware may have placed additional files, administrator accounts, or scheduled tasks elsewhere on the server." publisher: "Wordfence" source_url: "https://www.wordfence.com/blog/2026/10/rank-math-seo-pro-3-0-123-malware/" verification: single-source-victim sourcing_note: > Rank Math is the disclosing party for its own distribution incident and Wordfence relays its notice without independent analysis, so every fact here is the vendor's. No source says how the distribution was compromised or who is behind it, and the vendor calls the affected population a limited number of users without giving a count. confidence: high references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 2 watchlist_hit: false actions: - "Find every WordPress site that your organisation, its web agencies or its hosting suppliers run with Rank Math PRO and establish whether 3.0.123 was downloaded or updated between 2026-10-15 20:02 UTC and 2026-10-16 07:12 UTC; on a site where it was activated, restore from a backup older than that window or, if cleaning by hand, delete the whole rank-math-pro folder and the malicious database options first, because the backdoor is rebuilt on page visits, and rotate every credential the site could reach." updates: [] migrated_from: null --- Rank Math says that some copies of Rank Math PRO 3.0.123, downloaded between 2026-10-15 20:02 UTC and 2026-10-16 07:12 UTC, contained malware that could compromise a website if the plugin was activated, and that it removed the files and released 3.0.124 ([Rank Math, 2026-10-16](https://rankmath.com/kb/pro-3-0-123-security-incident/)). It says the malware can recreate its hidden backdoor whenever someone visits the website, so removing suspicious files before disabling the mechanism that recreates them may not resolve the infection ([Rank Math, 2026-10-16](https://rankmath.com/kb/pro-3-0-123-security-incident/)). Wordfence adds that the malware may establish persistent access, contact a remote host, and expose WordPress credentials, database credentials, API keys and other secrets that the web server can reach, and that Rank Math says it holds records of who downloaded an affected copy ([Wordfence, 2026-10-17](https://www.wordfence.com/blog/2026/10/rank-math-seo-pro-3-0-123-malware/)). The signs Rank Math lists are three malicious entries in the WordPress options table, hidden PHP backdoors in the must-use plugins directory and in other plugin and theme folders, unknown administrator accounts, a fake core file under wp-includes, .htaccess rules that let .cache files run as PHP, PHP files in the uploads directory and a web-user cron entry carrying a marker comment ([Rank Math, 2026-10-16](https://rankmath.com/kb/pro-3-0-123-security-incident/)). **Exposure:** a site that downloaded or updated Rank Math PRO 3.0.123 inside the stated window; Rank Math says the installed version shows under Plugins ([Rank Math, 2026-10-16](https://rankmath.com/kb/pro-3-0-123-security-incident/)), and Wordfence stresses that 3.0.123 alone does not establish compromise ([Wordfence, 2026-10-17](https://www.wordfence.com/blog/2026/10/rank-math-seo-pro-3-0-123-malware/)). Rank Math says a copy installed and activated in the window means a compromised site, a copy installed but never activated means deleting the files, installing 3.0.124 and scanning, and a copy only downloaded shows no sign of compromise from this incident alone ([Rank Math, 2026-10-16](https://rankmath.com/kb/pro-3-0-123-security-incident/)). **Detection:** the web-server user's crontab and the WordPress scheduled events, the list of administrator accounts, WordPress core integrity (wp core verify-checksums), PHP files under the must-use plugins and uploads directories and in other plugins and themes, and web-server egress to the host Rank Math names ([Rank Math, 2026-10-16](https://rankmath.com/kb/pro-3-0-123-security-incident/)). Rank Math also says the attacker may have changed things outside the WordPress directory, so review SSH authorized_keys files and other users' crontabs ([Rank Math, 2026-10-16](https://rankmath.com/kb/pro-3-0-123-security-incident/)). Post-patch compromise check: updating replaces the affected package but does not remove files, accounts or scheduled tasks the malware already created elsewhere ([Wordfence, 2026-10-17](https://www.wordfence.com/blog/2026/10/rank-math-seo-pro-3-0-123-malware/)). **Defender takeaway:** treat a site that activated an affected copy as compromised: restore from a backup older than 2026-10-15 20:02 UTC, or, if cleaning by hand, delete the whole plugin folder (deactivating is not enough), remove the malicious options and block the malicious host Rank Math names before anything else, then clean the rest; either way rotate the WordPress, database, API, hosting and SSH credentials the site could reach, and install 3.0.124 only from the vendor's own account page, since Rank Math says it sends no login or download links by email ([Rank Math, 2026-10-16](https://rankmath.com/kb/pro-3-0-123-security-incident/)).