SEO plugins are supposed to help strangers find your website. Rank Math PRO users found out this week that one version did that a little too well: it let attackers find their way into the site and stay there. Supply-chain attacks have officially landed in the WordPress plugin world.
Eleven Hours, One Poisoned Release
Attackers injected malware into Rank Math PRO version 3.0.123, the premium edition of a popular WordPress SEO plugin. Anyone who downloaded or updated it between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026 may have installed the tainted build. Rank Math says it "immediately removed the affected files and released a clean version, Rank Math PRO v3.0.124."
The payload was not subtle. According to SecurityWeek, once the plugin was activated it could provide persistent access, expose credentials and API keys, rebuild a hidden backdoor on every page visit, drop fake WordPress core files, rewrite .htaccess so .cache files run as PHP, schedule cron jobs, and tamper with other plugins and themes. It could even reach outside the WordPress installation.
Updating Fast Was the Trap
The painful part is that the sites that got hit were the diligent ones. Auto-updates, prompt patching, a clean dashboard... all the habits we preach. When the update channel itself is compromised, being quick to update is exactly how the malware gets in.
And upgrading to 3.0.124 doesn't fix it. The guidance is to treat any site that activated 3.0.123 during the window as compromised and restore from a pre-incident backup. If that isn't possible, delete the plugin folder, remove the malicious database entry, block rank1cdn[.]com, hunt down unfamiliar PHP files and admin accounts, check SSH authorized_keys and crontabs, then rotate every password. Malware that sets up its own cron jobs doesn't go away because you uninstalled the plugin.
Trust your vendors, but keep backups like you don't.
If this one made you wonder what else is quietly running in your plugin folder, our free guide, the Developer's Security Checklist for defending against supply-chain attacks, explains how to vet, pin, and monitor third-party code before it vets you.
Source: SecurityWeek