Security notice
Malware in Rank Math PRO downloads on 16 October
Rank Math found malware in some copies of its PRO plugin, version 3.0.123, that were downloaded or installed as an update between 7:02am and 6:12pm AEDT on Friday 16 October 2026. It has released a clean 3.0.124 and says any site that activated an affected copy should be treated as compromised. The free Rank Math SEO plugin from WordPress.org was not affected.
What happened
Rank Math is a popular SEO plugin for WordPress. The free version comes from WordPress.org, while the paid version, Rank Math PRO, is supplied by Rank Math itself.
On the morning of Saturday 17 October, Rank Math published a notice saying that some copies of Rank Math PRO 3.0.123 downloaded between 20:02 UTC on 15 October and 07:12 UTC on 16 October contained malware. That is 7:02am to 6:12pm AEDT on Friday 16 October, a little over 11 hours, and it covers copies installed as an update as well as those downloaded by hand. Rank Math removed the files and released a clean version, 3.0.124.
This is a supply chain attack. The websites weren't broken into from outside: the malware arrived inside the plugin, from the company their owners rely on to supply it. Rank Math has not said how the malicious files got into its downloads. Rank Math PRO 3.0.123 had been out since 7 October, and Rank Math only names copies downloaded in that window, so a site on 3.0.123 is not necessarily affected. It depends on when that copy was downloaded.
Rank Math says an affected copy could compromise a site once the plugin was activated. The malware can rebuild a hidden backdoor whenever someone visits the site, and Rank Math advises assuming that any passwords, keys and other secrets the site could reach have been exposed. Wordfence, which assigned it CVE-2026-111862, rates it 9.8 out of 10 and notes that it may communicate with a domain called rank1cdn.com.
Rank Math describes the number affected as limited and says it has notified every affected customer.
You can read Rank Math's notice, which lists every sign to check for and the steps in full.
Who is at risk
- Sites running Rank Math PRO that downloaded or updated to 3.0.123 between 7:02am and 6:12pm AEDT on Friday 16 October. If the plugin was activated, Rank Math says to treat the site as compromised.
- Sites where an affected copy was installed but never activated. Rank Math says to delete it, install 3.0.124 and run a security scan.
- Copies that were downloaded but never installed are not, on their own, a sign that a site was compromised, according to Rank Math.
The free Rank Math SEO plugin from WordPress.org was not affected, and Rank Math says sites using it need no action.
As part of its response, Rank Math also removed free rankmath.com accounts registered between 13 and 16 October 2026. The plugin keeps working, but the features that rely on the account, such as Google Search Console data, need the account re-created and the site reconnected. Rank Math has emailed the people affected.
What to do if you run Rank Math PRO
- Check which version is installed, under Plugins in WordPress. If Rank Math PRO is on 3.0.123 and could have been downloaded or updated during those hours, work through Rank Math's steps for your case.
- If an affected copy was activated, restore the site and its database from a backup taken before 7:02am AEDT on 16 October, run a security scan, then install 3.0.124.
- Change every password and secret the site could reach, even after restoring a backup. That means WordPress and database passwords, the security keys and salts in
wp-config.php, payment, email and other API keys, and hosting, FTP and SSH logins. - Without a clean backup, clean the site in the order Rank Math sets out. Delete the whole
rank-math-profolder first, because deactivating the plugin is not enough. Then remove the database entries Rank Math names and block connections torank1cdn.com, before looking for anything else left behind. - Look for administrator accounts you don't recognise, particularly usernames starting with
wpsupport_or email addresses ending in@wp-mail.net, and for a file calledwp-includes/class-wp-cache-util.php, which is not part of WordPress. - Install 3.0.124 once the clean-up is done. Updating on its own is not enough, because the attacker may have left files, accounts or server changes behind. Download it by going to rankmath.com yourself and signing in, as Rank Math says it will never send login or download links by email.
If you're not comfortable working with your site's files and database, Rank Math recommends asking your host or a security professional to do it.
How this affects our clients
Our Jigsaw sites don't run WordPress plugins, so this attack could not reach them. Jigsaw is our own website platform, the one we build on and move clients onto in place of WordPress for most small business sites, and you can read more about it here.
If you run Rank Math PRO on a WordPress site and would like a hand checking it, request a chat.
