COPIES of Rank Math PRO, the paid WordPress SEO plugin, were found to have been delivered with malware in updates between 20:02 UTC on 15 October 2026 and 07:12 UTC on 16 October 2026, according to Rank Math. The firm said sites that installed and activated one of the tainted copies should be treated as compromised, with the malware capable of recreating a hidden backdoor whenever a site is visited.
Rank Math subsequently released a clean build, version 3.0.124, but warned that simply installing this update does not remove files, administrator accounts, or scheduled tasks that the malware may already have placed elsewhere on the server. Wordfence’s advisory on 17 October echoed the same concerns about incomplete cleanup.
The incident is limited to the PRO plugin (rank-math-pro) downloaded or updated from rankmath[.]com; the free Rank Math plugin on WordPress[.]org is not named in the notice.
Rank Math outlines three recovery scenarios: (1) if 3.0.123 was installed and activated during the window, treat the site as compromised even after updating to 3.0.124 and follow recovery steps; (2) if installed but not activated, delete the plugin files, install 3.0.124 from Rank Math, and run a security scan; (3) if downloaded but never installed or activated, the incident alone does not indicate compromise.
Evidence from Wordfence and Patchstack classifies the issue as a backdoor, with CVE-2026-111862 assigned by Wordfence and a rating of 9.8/10. The recommended remediation includes a restore from before 20:02 UTC on 15 October if possible, otherwise a fixed, manual cleanup sequence starting with deleting the plugin folder and specific database entries, followed by a thorough scan and verification checks.