On October 16, 2026, Rank Math said that copies of its paid plugin, Rank Math PRO, contained malware. This post explains what happened, who is affected, and what to do next. It is written for nonprofit leaders and small business owners, not developers.
What happened
Copies of Rank Math PRO that were downloaded from rankmath.com, or delivered as updates, between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware. In Central time, that is 3:02 PM on October 15 to 2:12 AM on October 16. About eleven hours.
Rank Math removed the affected files and released a clean version, 3.0.124. The malware can recreate its hidden backdoor whenever someone visits an affected site. A backdoor is a hidden way for someone else to get into your website.
Who is affected
Only Rank Math PRO is named. The free Rank Math SEO plugin from WordPress.org is not part of the notice.
The version number alone does not tell you. Version 3.0.123 is dated October 7, more than a week before the window opened. A copy you got before the window is outside it.
Rank Math sorts sites into three cases:
- Installed and activated during the window. Treat the site as compromised, even if it has since been updated to 3.0.124.
- Installed but never activated. Delete the plugin files, install 3.0.124 from your Rank Math account, and run a security scan.
- Downloaded but never installed or activated. Nothing in this incident alone indicates the site was compromised.
If you are not sure which case you are in, ask whoever manages your site. Rank Math also says to contact its support team.
Why updating is not enough
Installing 3.0.124 replaces the plugin. It does not remove files, administrator accounts, or scheduled tasks the malware may have placed elsewhere on the server. That is why the cleanup has a specific order.
What to do
If you have a backup from before 3:02 PM Central on October 15, this is Rank Math’s preferred route. Restore the backup of the site and its database. Run a security scan. Change every password and credential. Only then install 3.0.124 from your Rank Math account.
If you do not have a clean backup, three things come first. Delete the entire Rank Math PRO plugin folder, because deactivating it is not enough. Remove three specific entries from the database. Block outgoing connections to one specific domain if your host allows it. After that, the search begins for leftover files, accounts, and scheduled tasks. This work is best handled by your host or a developer.
Wordfence adds a caution. Not finding anything does not, by itself, prove a site is clean.
Change every password and key
Do this in every case, even after restoring a backup. Assume anything the site could reach may have been exposed. That includes WordPress passwords, the database login, payment and email settings, API keys, hosting and FTP access, and two-factor authentication for administrators.
Questions to ask your host or developer
- Was Rank Math PRO installed, updated, or activated on my site between 3:02 PM on October 15 and 2:12 AM on October 16, Central time?
- Do we have a backup from before that time?
- Can you follow the steps in Rank Math’s notice and Wordfence’s advisory, and change our credentials?
What Rank Math has not said
Rank Math has not said how the malicious files entered its system, how many customers received them, or whether automatic updates delivered them. It says it is taking steps to reduce the risk of similar incidents.
The Hacker News reports this is at least the third time this year that a premium WordPress plugin’s own update channel delivered backdoored builds. Earlier cases involved Smart Slider 3 Pro in April and ShapedPlugin’s Pro plugins in June. Nothing published links the attackers behind those incidents to this one.
One habit worth building
Many small organizations are not sure which plugins their site runs, or who would hear about a notice like this. Three habits help. Know who is responsible for your site. Keep dated backups of the site and database. Read security notices from the plugins you pay for.
I put these steps into a short guide for anyone who asks. Reach out through pittmanunlimited.com and I will send you a copy.
Sources