● Covered by 2 sources · 2 reportsMedium impact2 negative
Rank Math PRO WordPress Plugin Compromised with Self-Restoring Backdoor
Key points
- Rank Math PRO distributed malware from October 15 (20:02 UTC) to October 16 (07:12 UTC).
- The malware installed a self-restoring backdoor on compromised WordPress sites.
- Affected version was 3.0.123, downloaded or updated during the specified window.
- Sites that activated the compromised plugin require manual cleanup beyond just updating.
- Only the PRO version was affected; the free version was not compromised.
Compromised Plugin Distribution
Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, were found to contain malware. These compromised versions were available for download from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16.
The affected plugin files, specifically version 3.0.123, installed a self-restoring backdoor on websites upon activation. Rank Math confirmed the incident in a security notice published on October 16, stating that the affected files were immediately removed and a clean version, 3.0.124, was released.
Impact on Websites
Any website that installed and activated one of these compromised copies should be treated as fully compromised. The malware is capable of recreating its hidden backdoor whenever someone visits the site, indicating persistent access.
The compromise could expose sensitive credentials and allow unauthorized control over the affected websites. Only the PRO version of the plugin was affected; the free version, active on over 4 million websites, was not compromised.
Cleanup and Remediation
Installing the clean version 3.0.124 replaces the plugin files but does not remove all malicious components. According to an advisory from Wordfence, the update does not eliminate files, administrator accounts, or scheduled tasks that the malware may have placed elsewhere on the server.
Users who installed and activated the trojanized version during the 11-hour window are advised to follow the manual cleanup procedures outlined in the vendor's advisory. This includes steps beyond a simple plugin update to ensure complete removal of the backdoor and any other malicious elements.
Identifying Affected Versions
The version number alone does not indicate whether a copy is affected. Rank Math's changelog dates version 3.0.123 to October 7, prior to the incident window. The compromise is limited to copies of 3.0.123 that were specifically downloaded or updated between 20:02 UTC on October 15 and 07:12 UTC on October 16.
Copies of 3.0.123 obtained before this window are not affected. Users need to verify if their installation falls within this specific download/update timeframe.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
CVE CVE-2026-1118629.8 CRITICALHow outlets covered it
The Rank Math PRO WordPress plugin was compromised in a supply-chain attack, distributing malware that created hidden backdoors on websites. Users who downloaded version 3.0.123 between October 15 and 16 should consider their sites compromised, as the malware could expose sensitive credentials and allow persistent access.
Copies of the Rank Math PRO WordPress SEO plugin downloaded or updated between October 15 and October 16 contained malware that installs a self-restoring backdoor. Websites that installed and activated these compromised versions should be treated as fully compromised, requiring manual cleanup beyond just updating the plugin.