Verify Rank Math PRO Activation Status Before Restoring Site Backups

Attackers gained persistent access to WordPress sites by injecting malware into legitimate Rank Math PRO distribution packages. The malicious code, hidden within version 3.0.123, granted intruders the ability to recreate hidden backdoors upon every page visit, steal credentials, and deploy fake system files. This supply chain compromise required no additional exploitation after the plugin was activated on a vulnerable server.

Rank Math confirmed that affected packages were distributed between 20:02 UTC on October 15, 2026, and 07:12 UTC on October 16, 2026. The vendor immediately removed the malicious files and released a clean update, version 3.0.124. However, installing the clean version does not remove existing malware, administrator accounts, or scheduled tasks that the attacker may have already placed on the server, according to a Wordfence advisory published on October 17.

Scope of Compromise

The incident affects only the paid Rank Math PRO plugin, which customers download directly from rankmath.com. The free version of Rank Math SEO, hosted on WordPress.org with more than 4 million active installations, is not involved in this breach. Wordfence noted that the version number alone cannot determine if a copy is malicious, as the official changelog dates version 3.0.123 to October 7, well before the contamination window opened.

Only copies downloaded or updated during the specific October 15-16 window are confirmed to contain malware. Users who installed version 3.0.123 before 20:02 UTC on October 15 are outside the affected range. Rank Math has emailed some users directly and advises anyone unsure of their installation status to contact support teams for verification.

Who is affected

Site administrators who installed and activated the compromised plugin during the incident window must treat their websites as fully compromised. Even if the site has since been updated to the clean version 3.0.124, the malware’s persistence mechanisms remain active. Rank Math states that these users should restore their sites from clean backups created before October 15, 2026.

Users who downloaded the plugin but never installed or activated it face no immediate risk from this specific incident. Those who installed but never activated the malicious version should delete the plugin files, install the clean version 3.0.124 from their account, and run a security scan to ensure no residual threats remain on the system.

What to watch

Administrators unable to restore from backups must perform extensive manual cleanup. Rank Math advises deleting the plugin folder, removing malicious database entries, and blocking the attacker’s domain rank1cdn[.]com. Users must also search for and remove suspicious PHP files, unknown administrator accounts, and modified .htaccess rules that allow .cache files to execute as code.

Cleanup efforts must also extend beyond the WordPress installation. Administrators should check for SSH authorized_keys files, cron jobs from other users, and suspicious processes that the web server user could access. After verifying the site is clean, users should change all passwords and install the legitimate version of the plugin.

What made it possible

Supply chain compromises exploit the trust users place in official software distribution channels. By injecting malicious code into legitimate updates, attackers bypass traditional security controls that verify package authenticity. This technique relies on the victim’s routine maintenance behavior, such as clicking "update," to execute the payload. The weakness lies in the assumption that official vendor packages are inherently safe, allowing attackers to gain initial access and establish persistence through self-repairing backdoors that survive standard file deletions.

Background: Malware

Malware targets small businesses because they lack layered defenses. You must isolate sensitive data, restrict software execution, and verify IT provider backup integrity. Focus on reducing the attack surface through strict access controls and regular, offline data restoration tests.

Read the full guide: Malware Defense: Practical Steps for Small Business Security

What to do and how to stay safe: Rank Math

• Check your plugin installation logs to determine if you activated Rank Math PRO version 3.0.123 between October 15 and October 16, 2026.
• Restore your website from a clean backup created before October 15, 2026, if you activated the plugin during that window.
• Run a comprehensive security scan for unknown administrator accounts, suspicious PHP files, and modified system configurations if restoration is not possible.
• Change all passwords, including database and server credentials, and verify that no unauthorized SSH keys have been added to your server.

Step-by-step guide: Multi-Factor Authentication Setup for Small Teams

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is the free Rank Math SEO plugin affected by this malware?

No, the free version hosted on WordPress.org is not affected; only the paid PRO version distributed from rankmath.com was compromised.

Does updating to version 3.0.124 remove the malware?

No, installing the clean version replaces the plugin files but does not remove existing backdoors, accounts, or scheduled tasks created by the malware.

How do I know if my version 3.0.123 is malicious?

You cannot tell by the version number; only copies downloaded or updated between October 15, 20:02 UTC and October 16, 07:12 UTC are confirmed malicious.