Rank Math PRO 3.0.123 Shipped with Malware (October 2026): Who Is Affected and What WordPress Site Owners Should Do

The company asks you to check the installed Rank Math PRO version under Plugins in the WordPress admin. The affected copies are 3.0.123 downloaded or updated during this window:

• UTC: October 15, 2026, 20:02 to October 16, 2026, 07:12
• Japan time: October 16, 2026, 5:02 to 16:12

The company gives different actions for each case.

If you only use the free Rank Math SEO plugin from WordPress.org, you are not affected and need to do nothing.

The company's recommended recovery is to restore both the site files and the database from a backup created before 20:02 UTC on October 15. In Japan time, that is a backup from before 5:02 on October 16.

After restoring, run a security scan, change credentials as in step 4, and install 3.0.124 last. If you are unsure how to restore a backup, the company suggests asking your hosting provider.

According to the company, the malware can recreate its hidden backdoor (a way back in for the intruder) whenever someone visits the site. It therefore asks you to finish everything that stops it rebuilding itself before anything else, and only then look for other suspicious files. Done the other way round, files you removed may come back.

First (complete all of these before moving on):

• Using your hosting file manager or FTP, delete the entire Rank Math PRO plugin folder (rank-math-pro). Deactivating is not enough
• Delete the malicious entry in the database's options table, whose names the company lists
• If your host or firewall allows it, block outgoing connections to the domain the company lists

Second, look for other changes the intruder may have left. The company points to these places (the specific file names, name patterns and markers are on its notice page):

• Administrator accounts you do not recognise (the company has published the username and email patterns to look for)
• Suspicious PHP files in other plugins' folders, in themes, and in the folder for plugins WordPress always loads
• A file posing as part of WordPress core that does not belong there (the company names it)
• Rules added to .htaccess that let files run as PHP when they normally would not
• Entries you did not add in the server's crontab and in WordPress scheduled events
• PHP files in the uploads/ folder; reinstall other plugins and themes from their official sources
• Server side: SSH authorized keys, other users' crontabs, running processes, and places outside the site that the web server can write to

On shared hosting, if you cannot see the server-side items yourself, the company asks you to have your host check them. For a broader map of where to look, see how to check whether a site or server was compromised.

The company says this step is essential even if you restored from a backup. Assume any credentials and secrets the compromised site could reach were exposed, and replace them with new values:

• WordPress account passwords, and any other passwords the site could reach
• The database username and password in wp-config.php
• The security keys and salts in wp-config.php (this site's note: regenerating them logs everyone out)
• Payment gateway keys, SMTP credentials and other API keys (this site's note: reissue them in each service's dashboard and disable the old ones)
• Hosting control panel, FTP/SFTP and SSH passwords or keys, and any secrets kept in environment variables
• Two-factor authentication for administrator accounts, reset where needed

Update the site's settings and any connected services with the new values. If you are not sure which credentials to replace, the company suggests reviewing them with your host or a security professional. For handling API keys, see .env files and API keys.

After the cleanup, the company asks you to:

• Run a scan with a reputable security tool such as a security plugin
• Run WP-CLI's wp core verify-checksums to confirm WordPress core files match the official release
• Run wp plugin verify-checksums --all for plugin files. Premium plugins may not support this, so compare them with a clean copy from the official source
• Watch outgoing connections and unusual activity over the following days, and check whether removed files reappear

If removed files come back or unusual activity continues, the cleanup may be incomplete. The company asks you to go back to the second part of step 3 and have your host or a security professional investigate.

The clean version is Rank Math PRO v3.0.124. The company asks you to open rankmath.com directly, log in to your account and download it from your downloads.

The company says it will never send login or download links by email. Treat unsolicited emails asking you to click a password-reset or download link as suspicious. It also says some users may be unable to log in and may need to reset their account password. For telling fake emails apart, see what phishing is.

This time, the company's preferred recovery was "restore from a backup taken before the window". But if your backups keep only one generation, a backup taken on the evening of October 16 overwrites the last clean state. If you noticed a day or more after the notice, there may be nothing clean left to restore.

As a first step, check that daily backups are kept for at least seven days and stored somewhere other than the site (outside your hosting account), and that they include both the database and the files. See backup and recovery essentials.

For checking plugin files after a cleanup, the company notes that checksum verification may not be available for premium plugins, and suggests comparing with a clean copy from the official source instead. Unlike plugins distributed on WordPress.org, premium plugins may have no such verification.

If you save the ZIP file you downloaded from the vendor for each version you install, you can later check whether the files on the server are the same as the ones you installed. For hardening WordPress overall, see WordPress security.

The credentials the company asks users to change cover the database, salts, payments, email sending, the hosting panel, FTP and SSH. Starting the search only after a compromise is found leads to missed ones.

Keep one page per site listing which secret is stored where and in which dashboard it is reissued, so that on a day like this you can change them in order. The same list helps when your hosting provider itself is breached (what to do when your hosting provider is breached).