Some Rank Math PRO 3.0.123 packages distributed through the vendor's official infrastructure contained malware that could compromise a website when the plugin was activated. The company removed the affected files and released the clean version 3.0.124. The incident concerns downloads and updates obtained during a specific window, from October 15, 2026, at 20:02 UTC to October 16 at 07:12 UTC.
In Romania, that corresponds to October 15 at 23:02 through October 16 at 10:12. The precise window matters when identifying installations requiring investigation: the version number alone, without the package acquisition time and a check of activation, does not establish a website's situation.
According to Rank Math, websites that installed and activated an affected package must be treated as compromised. The required response includes recovering or cleaning the installation, reviewing access and replacing credentials. These activities fall within website security, because an altered extension can introduce files and access mechanisms into several parts of the same installation.
The incident involves certain PRO packages, with three separate cases
Rank Math PRO is the commercial edition of the WordPress SEO plugin. The vendor's notice separates that distribution from the free version available through WordPress.org. The company states that the free edition was not affected by this incident's malware, although some free accounts were changed during its response.
The first case described by the vendor involves installing and activating the affected release during the specified period. Those websites are to be handled as compromised, with a review of changes made by the attacker. A website loading normally, or its WordPress dashboard remaining accessible, does not replace examination of the components listed in the notice.
The second case concerns packages installed but never activated. The vendor calls for deletion of those files, installation of the clean 3.0.124 package and a security scan. That instruction differs from the response for websites which have already executed the altered plugin.
The third case is downloading the archive without installing or activating it. According to the company, that alone is not an indication that a website was compromised in this incident. Separating the three situations sets intervention priorities and avoids assigning the same consequences to a locally downloaded file and a plugin executed on a server.
Persistence mechanisms extend checks beyond the plugin
In its remediation guidance, Rank Math says the malware can rebuild a hidden access component when someone visits the website. Consequently, deactivating the plugin or deleting one suspicious file does not address the persistence mechanism described by the vendor. Cleanup must also cover the elements capable of recreating removed files.
The vendor's list includes malicious database entries, hidden PHP files, unauthorized administrator accounts and a file impersonating a WordPress core component. It also identifies server configuration changes that allow files with extensions not normally used for PHP code to be executed.
Checks cover Must-Use extensions, directories belonging to other plugins and themes, and the area intended for uploaded files. The company also requests examination of scheduled tasks. This review scope follows the mechanisms described in the incident, which can retain access independently of the SEO extension's main file.
The notice also includes server-level checks covering SSH access, scheduled operations associated with system users and locations writable by the web process. For customers on shared hosting without visibility into these components, the vendor identifies the hosting provider's involvement as part of the investigation.
Clean backups and new credentials address different parts of recovery
Rank Math's preferred recovery route for a compromised website is to restore its files and database from a backup created before the affected window began. The reference time is October 15 at 20:02 UTC. After restoration, the company calls for a security scan, replacement of credentials and installation of the clean plugin release.
Where an eligible backup is unavailable, the vendor describes manual cleanup that first addresses the mechanism rebuilding malicious components and then examines additional changes. That sequence matters for the identified persistence. The instructions require post-intervention checks and monitoring for the return of removed files or suspicious activity.
The credentials to be replaced extend beyond WordPress account passwords. Rank Math includes database access, installation security keys and secrets, SMTP services, API keys and payment-platform credentials accessible to the website. Hosting accounts and FTP, SFTP and SSH access are also listed.
For two-factor authentication, the vendor calls for a review of administrator account protection and resets where necessary. Credential replacement also applies to websites recovered from backups, because restoring older files does not replace access values that may have been exposed during the compromise.
For integrity checks, the notice points to comparisons of WordPress components with official copies and verification of plugin files. The company notes that checksum verification is not available for every commercial extension. In such cases, files need to be compared with clean packages obtained through the official distribution.
Some free accounts require reconnection
Separately from the malware in the PRO edition, Rank Math removed free accounts registered between October 13 and October 16 while refreshing its own systems. The vendor says affected users received instructions to recreate their accounts. The free plugin continues operating, while the website's SEO settings, metadata and content remain intact.
Features dependent on the account connection require reconnection, however. The list includes Google Search Console and Google Analytics data displayed inside Rank Math, keyword position tracking and the platform's AI tools. This account issue is described separately from compromise of websites that activated altered PRO packages.
