Develop Better SolutionsBlog

Severity: CriticalDisclosed WordPress

Some Rank Math SEO PRO 3.0.123 downloads contained malware: check and install 3.0.124

Copies of Rank Math SEO PRO 3.0.123 downloaded on October 15 and 16, 2026 carried malware. The free plugin is not affected.

Affects:Rank Math SEO PRO 3.0.123Downloaded Oct 15 to 16, 2026

In October 2026, Rank Math disclosed that some copies of its paid plugin, Rank Math SEO PRO version 3.0.123, contained malware. Wordfence published a warning on October 17, 2026 (CVE-2026-111862). This was not a coding mistake but a supply-chain compromise: the files distributed during a short window were altered.

According to Rank Math, the affected copies were downloaded or installed by update between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Once activated, the malware could keep hidden access to the site, create administrator accounts, and expose passwords, database credentials and API keys. Rank Math removed the files and released version 3.0.124 as the clean replacement.

Updating alone is not enough if an affected copy was active, because the malware may have left other files behind.

Who is affected

  • Sites that downloaded or updated to Rank Math SEO PRO 3.0.123 during the window above.
  • Having version 3.0.123 does not by itself prove a compromise. Rank Math says it has records identifying who downloaded an affected copy.
  • The free Rank Math SEO plugin from WordPress.org is not affected, according to Rank Math.

How to check your site

  1. In WordPress, open Plugins and look for Rank Math SEO PRO and its version.
  2. If it is 3.0.123, find out when it was installed: check your update emails, your host's logs, or ask your developer.
  3. Check your inbox for a message from Rank Math about this incident.

What to do now

  1. If an affected copy was activated, treat the site as compromised. Rank Math recommends restoring the site and database from a backup made before October 15, 2026 at 20:02 UTC, then installing 3.0.124 from your Rank Math account.
  2. Change all passwords and keys the site could reach: WordPress, database, hosting panel, FTP or SSH, payment and email services, and API keys.
  3. If you have no clean backup, ask your host or a security professional to clean the site. Deactivating the plugin is not enough.
  4. If 3.0.123 was installed but never activated, delete it, install 3.0.124 and run a security scan.
  5. Download the update by logging in at rankmath.com directly, not through links in emails.

This alert reports what the sources listed below published and is not a guarantee about any specific site.

Sources