WordPress · disclosed 17 October 2026
Rank Math SEO PRO 3.0.123 backdoored at the vendor
Tampered builds of the Rank Math SEO PRO WordPress plugin were served from the vendor's own update channel between 15 October 20:02 and 16 October 07:12 UTC. They plant persistent backdoors, create rogue admin accounts and steal server secrets. The free WordPress.org plugin was not affected.
- Detectable by a website scanYes
- Last reviewed23 October 2026
Affected packages
| Package | Affected versions |
|---|---|
seo-by-rank-math-pro | 3.0.123 (downloaded 15–16 Oct) |
What to do
- Updating to 3.0.124 does not remove planted backdoors. If your site updated during the window, restore from a backup taken before 15 October and rotate all secrets.
Sources
- BleepingComputer: Rank Math compromised to backdoor websites
- Patchstack: Rank Math SEO PRO 3.0.123 embedded malicious code
We update this page as new information is published. Package versions are also checked live against OSV.dev during every audit, so newly flagged versions are caught even before this page changes.