Rank Math PRO Plugin Compromised: WordPress Sites That Updated on 15-16 October Should Be Treated as Breached

Rank Math has confirmed that copies of Rank Math PRO, the paid version of its WordPress SEO plugin, were malicious if they were downloaded from rankmath.com or delivered as updates between 20:02 UTC on 15 October and 07:12 UTC on 16 October. Any site that installed and activated one of those copies should be treated as compromised. The malware can recreate its hidden backdoor whenever someone visits the site.

Rank Math has removed the affected files and released a clean version, 3.0.124. However, Wordfence warns that installing it does not remove files, administrator accounts or scheduled tasks the malware may already have placed elsewhere on the server. The version number alone does not show whether a copy is affected: version 3.0.123 is dated 7 October, and a copy obtained before the window opened is outside the incident. The free plugin on WordPress.org is not named in the notice.

The attacker may also have left backdoor files in other plugin and theme folders, created administrator accounts, changed server settings, and added scheduled tasks and SSH keys. Any password, database credential or API key the site could reach should be assumed exposed. Wordfence rates the incident 9.8 out of 10 (CVE-2026-111862). Neither Rank Math nor Wordfence has published a code analysis or named who is behind it.