Rank Math, the developer behind the popular Rank Math SEO plugin, has disclosed that some copies of Rank Math SEO PRO version 3.0.123 contained malware. The company says the affected builds were distributed through the plugin’s update mechanism during a specific window of time.
According to Rank Math, sites that downloaded or installed the update between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC may have received the compromised version. Sites that updated outside that roughly 11 hour window appear not to be affected.
What Site Owners Should Do
If your WordPress site runs Rank Math SEO PRO and received an automatic or manual update during that window, treat the installation as potentially compromised until verified otherwise. Standard incident response steps apply in cases like this:
- Check the installed version and confirm whether the update was applied during the affected window
- Replace the plugin files with a known clean copy from an official source
- Scan the site for unexpected files, admin accounts, or scheduled tasks
- Rotate WordPress admin, database, and hosting account credentials as a precaution
- Review server and access logs for unusual activity around the affected dates
This incident is a reminder that even updates from trusted, widely used plugins can be compromised at the distribution level, not just through unpatched vulnerabilities in the code itself. Hosting providers and site administrators managing multiple WordPress installs with Rank Math SEO PRO should check each site individually rather than assuming a single scan covers the whole fleet.
Further technical detail on the nature of the malware had not been published at the time this report was compiled. Site owners should watch for additional guidance from Rank Math on remediation and verification steps.