Malware Found in Some Rank Math SEO PRO 3.0.123 Downloads
Rank Math has confirmed that certain copies of its SEO PRO plugin version 3.0.123 were compromised with malware during a narrow update window in mid October 2026.
Tag
wordpress security
All posts in this stream, newest first.
Wordfence Bug Bounty Program Logged 1,066 Vulnerability Submissions in June 2026
Wordfence's June 2026 report shows its bug bounty program remains a steady pipeline of WordPress vulnerability discoveries, with researcher submissions triaged and responsibly disclosed to plugin and theme vendors.
Inside a Brute-Force Campaign Against wp-login
A walkthrough of what a real credential-stuffing attack against wp-login.php looks like in the access logs, and the layered defenses that turn it from a threat into a non-event.
Supply-Chain Attacks: When the Plugin Update Is the Malware
Abandoned plugins get bought, weaponized, and pushed back out as trusted updates. Here is how the pattern works and how to shrink your exposure before it becomes your incident.
An Incident Response Plan Sized for a Small Site
You do not need a security operations center to handle a hack well. You need a short plan you wrote before the bad day, and this is the template.
SEO Spam, Redirect Hacks, and Miners: WordPress Malware Taxonomy
Not all WordPress infections look the same because they aren't built for the same purpose. Here's how to recognize the common categories and what each one is actually trying to do to your site.
Finding Backdoors: Where Attackers Hide in WordPress
A compromised site rarely gets fully cleaned on the first pass. Here is where attackers plant their return tickets, and how to find and remove them systematically.
API Keys and Secrets: Stop Committing Them to the Theme
A practical guide to keeping API keys and credentials out of your WordPress codebase, building a rotation habit, and responding fast when a secret does leak.
Security Plugins Compared: What They Catch and What They Can’t
Firewall plugins, malware scanners, and login guards each cover a real slice of WordPress security, but none of them reach the server or network layer where a lot of the actual damage happens.
How WordPress Vulnerabilities Get Found, Reported, and Patched
A look at the pipeline behind every WordPress security update, from researcher discovery to CVE listing to the patch gap that makes update urgency real.