The popular WordPress plugin Rank Math PRO has been compromised by a malware backdoor, according to a security notice released by Rank Math on October 16. The compromised copies were downloaded or updated between 20:02 UTC on October 15 and 07:12 UTC on October 16. Any website that installed and activated these versions is considered compromised.
Impacted Users and Initial Response
Rank Math has acted swiftly by removing the affected files and releasing a clean version, 3.0.124. However, this update does not automatically eliminate any unauthorized administrator accounts, scheduled tasks, or files that the malware may have placed on the server, as per Wordfence’s advisory on October 17. Users are urged to take immediate action to secure their sites.
The incident specifically affects the PRO version of Rank Math, which is distributed through rankmath.com, not the free version available on WordPress.org. Users need to determine if their plugin version was affected during the specified time window and follow appropriate recovery steps based on their circumstances.
Understanding the Malware Impact
Rank Math’s security notice outlines several potential actions of the malware, including creating hidden backdoors and possibly exposing sensitive data such as passwords and API keys. The malware could also create fake WordPress core files, alter .htaccess settings, and establish unauthorized administrator accounts.
The severity of this breach is underscored by Wordfence, which has rated it 9.8 out of 10. The breach has been assigned CVE-2026-111862, yet the identity of the perpetrators remains unknown. Recovery involves a comprehensive cleanup process, which includes deleting plugin files, removing unauthorized entries from the database, and blocking certain outgoing connections.
Steps for Recovery and Future Precautions
Rank Math advises restoring from a backup made before 20:02 UTC on October 15 if available, followed by a security scan and updating credentials. In the absence of a backup, a detailed manual cleanup is required, including deleting the rank-math-pro plugin folder and certain database entries.
It is crucial to change all passwords and credentials, including database and WordPress admin details, to ensure security. Users should download the clean version 3.0.124 directly from their Rank Math account. Rank Math’s ongoing efforts to prevent future incidents include enhancing their security measures, though specific details have yet to be disclosed.
Recent trends show that this is not an isolated incident. Similar attacks on WordPress plugins have occurred this year, highlighting a growing threat in the WordPress ecosystem. Users are advised to remain vigilant and ensure regular updates and security scans are part of their website maintenance routine.
