Which versions of Rank Math PRO were affected by the malware?

The malicious code was injected into Rank Math PRO version 3.0.123 packages distributed between October 15 and October 16.

Was this caused by a vulnerability that attackers exploited on my site?

No, the malicious code was added to the plugin packages themselves and delivered through the normal distribution path, rather than being a flaw exploited against sites after the fact.

Will simply updating Rank Math PRO remove the malicious code?

Possibly not — reports indicate only a subset of packages carried the malicious code and that updating afterward may not remove it, so follow the vendor's official guidance instead of relying on an update alone.

How can I check whether my site is affected?

Confirm whether version 3.0.123 is installed and when it was obtained, compare plugin files against a fresh vendor-confirmed copy, and review admin accounts, scheduled tasks, and recently modified files.

What should I do if I find evidence of compromise?

Rotate WordPress admin passwords, database credentials, hosting and FTP/SFTP logins, and API keys, invalidate active sessions, and restore from a known-good backup taken before October 15 followed by installing a verified plugin version.

Rank Math PRO 3.0.123 Malware: Oct 15-16 Supply Chain Attack

A trusted update channel is supposed to be the safe way to get software. In the Rank Math PRO supply chain attack, that assumption failed. According to SecurityWeek, hackers injected malware into Rank Math PRO version 3.0.123 packages that were distributed between October 15 and October 16. Site owners who downloaded or installed the plugin in that window have reason to take a closer look.

The public details are still limited, so this post sticks to what has been reported and focuses on practical steps you can take.

What happened to Rank Math PRO 3.0.123

The core facts are straightforward. Malicious code was added to Rank Math PRO 3.0.123 packages, and those packages were distributed over a roughly two-day window, October 15 to October 16. Rank Math PRO is a premium WordPress plugin, and the compromise affected the plugin package itself rather than a flaw a visitor would have to exploit.

That distinction matters. This was not a bug that attackers found and used against sites after the fact. The code was reportedly delivered through the same distribution path that customers rely on to get legitimate software. Other pages covering the incident indicate that only a subset of packages carried the malicious code, and that simply updating afterward may not remove it. We have not independently verified those details, so treat them as leads to confirm against the vendor's own guidance.

How to check your site and remove the malicious code

If you downloaded, installed, or auto-updated Rank Math PRO on or around October 15 or 16, assume you need to verify your install. A reasonable approach:

Confirm your version and install date. Check whether version 3.0.123 is installed and when the package was obtained. If it was outside the October 15-16 window, your risk is lower, but still confirm with the vendor.
Look for vendor guidance first. Follow the official instructions from the Rank Math team for identifying affected packages and cleaning up. Do not rely on a plugin update alone, since an update does not necessarily remove code that has already run.
Compare files against a clean copy. Download a fresh, vendor-confirmed copy of the plugin and compare its files with what is on your server. Unexpected files or modified code are red flags.
Review users, scheduled tasks, and recently changed files. Look for administrator accounts you did not create, unfamiliar scheduled tasks, and files modified around the affected dates.
Rotate credentials. Change WordPress admin passwords, database credentials, hosting and FTP/SFTP logins, and API keys stored on the site. Invalidate active sessions.
Restore from a known-good backup if needed. If you find evidence of compromise, a backup taken before October 15 is often the cleanest path, followed by installing a verified plugin version.

If you are unsure, a hosting provider or a professional incident responder can help scan and clean the site.

Why plugin supply chain attacks put visitors at risk

A WordPress plugin runs with deep access to your site. It can read the database, modify pages, and add scripts that load in every visitor's browser. When malicious code arrives inside a legitimate plugin, it inherits that trust.

For site owners, the risk includes unauthorized access, defaced or redirected pages, and stolen data. For visitors, the risk is indirect but real: a compromised site can serve malicious scripts, push unwanted redirects, or capture information entered on forms. Your readers and customers did nothing wrong, yet they bear part of the exposure.

Supply chain attacks are also hard to spot because the usual warning signs do not apply. The software came from the expected source, installed normally, and may behave as advertised while doing something else in the background.

What This Means For You

If you run a WordPress site with Rank Math PRO, check today whether version 3.0.123 was installed during the October 15-16 window. If it was, treat the site as potentially compromised until you have verified otherwise. If you only use the free Rank Math plugin or do not use it at all, this specific report does not point to you, but the lesson still applies to every plugin you run.

If you are a visitor to WordPress sites rather than an owner, there is little you can do directly. Keeping your browser and security tools up to date and being cautious about unexpected redirects or pop-ups is sensible general practice.

A WordPress checklist for verifying software integrity

You cannot eliminate supply chain risk, but you can make it easier to catch. Build these habits into routine maintenance:

Keep an inventory. Know every plugin and theme you run, plus versions and sources.
Stage updates. Test updates on a staging copy before pushing to production, especially for premium plugins, and consider delaying auto-updates on critical sites by a day or two.
Verify downloads. When a vendor publishes checksums or signatures, use them. Checking a cryptographic hash is a simple form of verification, and the idea behind it connects to broader cryptographic concepts such as a zero-knowledge proof, which shows how something can be verified without exposing underlying secrets.
Monitor file changes. Use file integrity monitoring so unexpected changes to plugin files trigger an alert.
Limit privileges. Use separate, least-privilege accounts and unique credentials for hosting, database, and admin access.
Keep tested backups. Store backups off the server and confirm you can restore them.
Follow vendor security notices. Subscribe to advisories for every plugin you depend on.

Takeaways

The Rank Math PRO supply chain attack is a reminder that a legitimate download is not automatically a safe one. Audit your Rank Math PRO installs today, confirm whether 3.0.123 was installed on October 15 or 16, follow the vendor's cleanup guidance, and rotate your credentials. Then make plugin integrity checks a regular part of how you manage your site, so the next incident is caught in hours rather than weeks.