Rank Math Supply-Chain Attack Steals Credentials and Backdoors Sites

Organisations using the Rank Math SEO PRO plugin must verify whether they installed a compromised package during a specific window in October 2026. The malicious code targets website integrity by stealing sensitive credentials and establishing persistent unauthorized access.

What does the malware do?

The malware embedded in the affected Rank Math SEO PRO version 3.0.123 packages can compromise a website if the plugin is activated. According to Rank Math, the code may establish persistent access, communicate with an external domain, and recreate hidden backdoors on page visits.

The threat also exposes WordPress credentials, database credentials, API keys, and other secrets accessible to the web server. Rank Math directs sites that activated an affected package to treat the website as compromised and take immediate remediation steps.

Which version and timeframe are affected?

The supply-chain compromise affects only a subset of Rank Math SEO PRO version 3.0.123 packages. According to the vendor, the malicious files were available for download or update between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC.

Installing version 3.0.123 outside this window does not indicate compromise. Rank Math removed the affected files from their distribution channels and released version 3.0.124 as the clean replacement for users to install.

What indicators should teams look for?

Rank Math identifies several specific incident indicators to help detect the compromise. These include three malicious wp_options keys, hidden PHP backdoors, and unauthorized administrator accounts created by the malware.

Additional indicators include a fake WordPress core file, PHP-executable .cache files, and a system cron marker. Security teams should scan their installations for these specific artifacts to determine if the malicious code was executed on their servers.

What comes next for users?

Users who installed the plugin during the confirmed window must treat their sites as compromised. Rank Math states that activating an affected package introduces malware that requires thorough investigation and cleanup.

The vendor has already removed the malicious files and provided version 3.0.124 as a clean update. However, simply updating does not remove the installed malware; manual remediation and credential rotation are necessary steps for affected sites.

What analysts watch for

Teams usually examine file modification timestamps to identify unauthorized changes during the incident window. Analysts check for new administrator accounts and review plugin directories for unfamiliar PHP files. They monitor outbound network connections for communication with suspicious domains. Persistence mechanisms like cron jobs and modified core files are primary targets for detection.

What to do and how to stay safe: Rank Math

• Verify the exact download or update timestamp of Rank Math SEO PRO version 3.0.123 against the October 15-16, 2026 window.
• Rotate all WordPress, database, and API credentials immediately if an affected package was activated on the server.
• Scan the installation for the specific indicators listed by Rank Math, including fake core files and hidden PHP backdoors.
• Install version 3.0.124 only after confirming the site is clean and all malicious artifacts have been removed.

Step-by-step guide: Ransomware Incident Response: 6 Common Misreadings Corrected

General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is every copy of Rank Math SEO PRO 3.0.123 infected?

No, only packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC are affected.

What credentials are exposed by the malware?

The malware can expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server.

Has Rank Math released a fix?

Yes, Rank Math removed the affected files and released version 3.0.124 as the clean replacement.