GoKawiilRank Math PRO WordPress plugin briefly served backdoored downloads
Rank Math says some downloads of its paid SEO plugin, version 3.0.123, between October 15 at 20:02 UTC and October 16 at 07:12 UTC contained malware capable of implanting hidden backdoors once activated. The vendor pulled the affected files and issued a clean version, 3.0.124, while the free Rank Math SEO plugin used by over 4 million sites was not affected.
GoKawiil's interpretation of the reporting above, not reported fact.
The malware reportedly establishes persistent access, contacts an external domain, and can expose database credentials and API keys, meaning affected site owners may need to rotate secrets and rebuild compromised backends. The incident underscores how plugin supply chains remain a recurring weak point for WordPress security, since a brief compromise at the source can propagate to any site that installed during that window.
- A malicious build of Rank Math PRO 3.0.123 was distributed for about 11 hours before being replaced by version 3.0.124.
- Only the paid PRO plugin was affected; the free Rank Math SEO version remained safe.
- Sites that activated the compromised version should assume compromise and follow the vendor's clean-up advisory, including checking for backdoors and rotating credentials.
Source: bleepingcomputer.com, 2026-10-19
Published there as: “WordPress SEO plugin Rank Math compromised to backdoor websites”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.