Did Rank Math Compromise Your Site With Malicious Code in Oct 2026?
Rank Math confirmed that some downloads of version 3.0.123 included malicious code during a specific window in October 2026.
Key points
- Rank Math disclosed malware in some copies of Rank Math SEO PRO 3.0.123.
- The affected update window was between October 15 and October 16, 2026.
- Wordfence published first-hand research detailing the incident timeline.
Rank Math has confirmed that certain downloads of its Rank Math SEO PRO plugin version 3.0.123 contained malware. According to the vendor, the compromised files were distributed through an update mechanism between October 15, 2026, at 20:02 UTC and October 16, 2026, at 07:12 UTC. Wordfence published first-hand research highlighting this breach of trust in the software supply chain.
Which version was affected?
Only Rank Math SEO PRO version 3.0.123 is confirmed to have contained the malicious code. Rank Math specified that the issue was limited to copies obtained or installed via the automatic update process during the defined window. Other versions of the plugin, including prior or subsequent releases, were not identified as containing this specific malware payload in the available reporting.
When did the exposure occur?
The exposure window lasted approximately eleven hours. Rank Math stated that the affected version was downloaded or installed between October 15, 2026, at 20:02 UTC and October 16, 2026, at 07:12 UTC. Any installation occurring outside this specific timeframe is not indicated as compromised by the vendor’s initial disclosure.
How was this discovered?
Wordfence published the first-hand research regarding the incident. Their analysis confirmed the presence of malware in the specific version downloaded during the stated window. The security firm’s report serves as the primary source for the technical details surrounding the compromised update distribution.
What happens next?
Rank Math has disclosed the issue to the public. Users who updated during the window must verify their installations. No specific patch or remediation steps were detailed in the provided source material beyond the identification of the affected timeframe.
What analysts watch for
Teams usually examine file hashes against known good baselines to detect unauthorized modifications in plugin updates. They check for unexpected outbound network connections from the web server, which may indicate command-and-control communication. Analysts also review file system changes for new executables or modified configuration files that persist after a standard update cycle.
What to do and how to stay safe: Rank Math
- Verify if your Rank Math SEO PRO was updated between October 15 and October 16, 2026.
- Check server logs for unusual activity originating from the plugin directory during that window.
- Monitor for unexpected outbound connections from your web hosting environment.
- Wait for official remediation guidance from Rank Math before applying further changes.
Step-by-step guide: How Windows Malware Removal Works: The Hidden Persistence Layer
General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is Rank Math SEO PRO 3.0.123 safe to install now?
Rank Math disclosed that some copies of version 3.0.123 contained malware during a specific update window in October 2026.
Who reported the malware in Rank Math?
Wordfence published first-hand research confirming the presence of malware in some downloads of the plugin.
What dates are affected by this Rank Math incident?
The affected period is between October 15, 2026, at 20:02 UTC and October 16, 2026, at 07:12 UTC.
