Overview
- A limited set of Rank Math PRO downloads delivered from rankmath.com between Thursday, Oct. 15 and Friday, Oct. 16 contained malware that planted a hidden backdoor.
- The backdoor can recreate itself on each page visit and can expose database credentials, API keys and other secrets accessible to the web server.
- Rank Math removed the tainted files and released Rank Math PRO v3.0.124, but installing the clean build does not remove malicious files, cron jobs, admin accounts or SSH keys the attackers may have placed.
- Rank Math advises restoring a backup made before 20:02 UTC on Oct. 15 as the preferred recovery; where no clean backup exists, owners must follow a strict manual cleanup order to remove plugin and server‑level artifacts.
- Security firms assigned the incident a high severity (Wordfence gave CVE‑2026‑111862 a 9.8 score) and researchers note this case continues a 2026 pattern of premium plugin update channels being abused, raising questions about vendor update integrity and disclosure.