Rank Math SEO PRO 3.0.123: malware distributed in some downloads via compromised update channel (Oct 15–16, 2026)
Severity: high · Patch status: no-fix-needed · Since 2026-10-17
Rank Math disclosed that some copies of Rank Math SEO PRO version 3.0.123 contained malware. The affected version was downloaded or installed via update between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC, meaning sites that updated during this window may be running a trojanized build of the popular WordPress SEO plugin. Wordfence published a PSA amplifying the disclosure. Rank Math has since addressed the issue, so users outside the window are unaffected; those who installed 3.0.123 during the window should treat their site as potentially compromised. No CVE has been assigned; details of the malware's capabilities have not been fully disclosed in the source.
What to do
- Check if Rank Math SEO PRO 3.0.123 was installed or updated between 2026-10-15 20:02 UTC and 2026-10-16 07:12 UTC
- If so, update to the latest clean version immediately and scan the site for malware and backdoors
- Rotate WordPress admin credentials, API keys, and any secrets accessible from the site
- Review site integrity: unknown admin users, modified core/plugin files, scheduled tasks, and outbound connections
- Check logs for suspicious activity since the update and consider professional incident response if compromise is suspected
Sources
All live incidents on Threat Watch
