RANK Math PRO for WordPress was compromised in a supply chain incident, with malicious code embedded in version 3.0.123 packages distributed between 15 October and 16 October 2026. Security Week notes that users who downloaded or updated to 3.0.123 during that window may have been infected. Rank Math subsequently removed the affected files and released a clean update, Rank Math PRO v3.0.124.
Administrators who installed and activated 3.0.123 in the affected period should treat their sites as compromised and restore from a clean backup created before the incident.
The malware is described as enabling attackers to gain persistent access, potentially exposing credentials, API keys and other secrets. It may recreate a hidden backdoor on each page visit, and its persistence could complicate manual cleanup. Practical remediation steps include deleting the Rank Math PRO plugin folder, removing a malicious database entry, blocking the attacker’s domain rank1cdn[.]com, and locating and removing suspicious PHP files and unknown administrator accounts.
The attackers may also deploy fake WordPress core files, modify .htaccess to execute .cache PHP code, drop .cache files with PHP, schedule tasks and cron jobs, and alter other plugins and themes. Additional indicators include changes outside the WordPress installation, so admins should inspect SSH authorized_keys files, non‑admin crontabs, suspicious processes, and other locations where the web server user has write access. After verifying a clean site, administrators should change all passwords and reinstall a clean Rank Math PRO.