Rank Math SEO PRO 3.0.123: Malicious Code Found in Oct 15-16 Downloads, Wordfence Confirms

Rank Math has confirmed that certain distributions of its SEO PRO plugin version 3.0.123 included malware. According to Wordfence’s research, the compromised files were available during a specific update window in mid-October 2026.

What happened

Rank Math disclosed that some copies of Rank Math SEO PRO version 3.0.123 contained malware. The vendor stated that the affected version was downloaded or installed through an update. The contamination window spanned from 20:02 UTC on October 15, 2026, to 07:12 UTC on October 16, 2026. Wordfence published the initial findings regarding this incident.

Why it matters

Organisations using WordPress must verify the integrity of their Rank Math installations. The incident involves a specific version distributed during a narrow time frame. Environments that applied this specific update during the stated hours are exposed to the malware contained in those copies.

Next steps

• Verify if your environment installed Rank Math SEO PRO version 3.0.123 during the specified UTC window.
• Isolate any servers that confirm installation of the affected build to prevent lateral movement.
• Audit file hashes against known good versions to identify tampering.
• Monitor for anomalous outbound connections that may indicate command-and-control activity.

Detection notes

Security teams should examine web server access logs for unusual request patterns originating from the plugin directory. Check for unexpected file modifications within the plugin folder structure during the affected timeframe. Look for new or modified PHP files that do not match the official release manifest. Analyse outbound network traffic for connections to unfamiliar domains or IP addresses. Review database entries for any injected scripts or altered configuration settings. Ensure endpoint detection tools are scanning for known malware signatures associated with recent supply chain attacks.

Background: Supply chain attacks

Prioritise binary verification and least-privilege execution for third-party code. Verify cryptographic signatures for every update, not just the initial install. Isolate vendor access to minimise lateral movement. These steps reduce the attack surface more effectively than perimeter firewalls alone.

Read the full guide: Prevent Supply Chain Attacks: Practical Controls for Third-Party Risk

What to do and how to stay safe: Rank Math

• Scan all WordPress installations for the specific version 3.0.123 of Rank Math SEO PRO.
• Restore affected sites from clean backups created before October 15, 2026.
• Monitor server resources for abnormal CPU or memory usage indicative of cryptomining or botnet activity.
• Review user activity logs for any unauthorised administrative changes made during the compromise window.

Step-by-step guide: Infostealers Explained: How Data Theft Happens and How to Stop It

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which version of Rank Math is affected?

Rank Math SEO PRO version 3.0.123 is the affected version.

When were the malicious downloads distributed?

The compromised files were downloaded between October 15, 2026, at 20:02 UTC and October 16, 2026, at 07:12 UTC.

Who reported the malware finding?

Wordfence published the first-hand research regarding the malware in the plugin downloads.