Rank Math PRO 3.0.123 shipped backdoored from vendor's own download server
The malicious build was live for an 11-hour window last week and any site that activated it should be treated as fully compromised today — waiting leaves an attacker-controlled, self-rebuilding backdoor and leaked site credentials in production.
Rank Math confirmed that downloads of Rank Math PRO v3.0.123 pulled from its official site between 2026-10-15 20:02 UTC and 2026-10-16 07:12 UTC contained malware that backdoors the WordPress site when the plugin is activated. The vendor pulled the files and released clean v3.0.124; reporting says the backdoor gives persistent access and can expose site credentials and API keys.
Affected: Rank Math PRO 3.0.123
How to Test
Check the plugin version and the file timestamps of wp-content/plugins/seo-by-rank-math-pro (and your download/update logs or WAF/CDN egress logs) for a 3.0.123 download or update between 2026-10-15 20:02 UTC and 2026-10-16 07:12 UTC; diff the installed plugin files against a clean v3.0.124 archive and scan for unexpected PHP files, new administrator users, unknown scheduled (wp-cron) tasks, modified wp-config.php/.htaccess and outbound connections from the web host.
How to Mitigate
Replace the plugin with clean Rank Math PRO v3.0.124; if 3.0.123 was activated in the window, restore the site from a backup taken before 2026-10-15, then rotate all WordPress administrator passwords, database credentials, wp-config.php salts/keys, and any API keys or tokens stored on or reachable from the host.