Users downloaded malicious versions of Rank Math PRO last week, after the WordPress SEO plugin was compromised in a supply chain attack. Some version 3.0.123 packages contained malware that could allow attackers to take over websites if the plugin was activated, according to Rank Math. A clean release, v3.0.124, has been published.
What happened
The distribution of the paid plugin was tampered with, so the package a customer downloaded was not the package the vendor intended to ship. All users who downloaded or updated their plugin to the affected version between October 15, 2026, at 20:02 UTC and October 16, 2026, at 07:12 UTC might have been infected.
The impact is not limited to the plugin itself. The malware may provide the attackers with persistent access to the compromised websites and could expose credentials, API keys, and other secrets. That makes this a credential exposure event as well as a site integrity event.
We immediately removed the affected files and released a clean version, Rank Math PRO v3.0.124.
How it was done
The reported detail is narrow, so it is worth being precise about what is known. Malicious code was present in some packages of a single version, and it ran when the plugin was activated on a site. The vendor pulled the affected files and shipped a clean build.
No actor has been confirmed, and the method used to place the files into distribution has not been described in the reporting. Treat anything beyond the above as unknown for now.
What to check
If you run WordPress with this plugin, work through the following on every site, including staging and archived installs.
Confirm the installed plugin version
Open Plugins in wp-admin, or run wp plugin list --format=table with WP-CLI on each host. Record the version for every site, not just production. Anything still on the affected build should be treated as suspect until proven otherwise.
Match your download time against the window
Check vendor account download logs, your artifact store, and file modification times with ls -l --time-style=full-iso on the plugin directory. Convert local timestamps to UTC before comparing. A download or update inside the stated window means you assume infection.
Diff the plugin files against a clean copy
Download the clean release separately, unpack it, and run diff -r against the installed directory. Look for extra PHP files, appended code at the end of legitimate files, and base64 or eval calls. Any unexplained file is a finding.
Hunt for persistence outside the plugin
Review admin users in wp_users, scheduled tasks via wp cron event list, must-use plugins in wp-content/mu-plugins, and the theme functions file. Also check crontab -l and any webshell-like files under the upload directory. Accounts or jobs you cannot tie to a change request are suspect.
Rotate every secret the site could reach
Replace database credentials, salts in wp-config.php, API keys, SMTP credentials, and any tokens stored in options or environment files. Revoke old keys at the provider rather than only replacing them locally. Treat shared keys reused across sites as exposed too.
Review access logs for the period after install
Grep web server logs for POST requests to plugin paths and for admin-ajax and xmlrpc traffic from unfamiliar addresses. Compare request volumes before and after the install date. Repeated requests to a single unexpected file path is a strong signal.