Malware Detected in Some Rank Math SEO PRO 3.0.123 Downloads

Wordfence published first-hand research confirming that some copies of Rank Math SEO PRO version 3.0.123 contained malware. Rank Math disclosed the incident, providing details about the specific version and the timeframe during which the compromised files were distributed to users.

The malicious code was present in Rank Math SEO PRO version 3.0.123. According to Rank Math, the affected copies were downloaded or installed through an update between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. This narrow window defines the period during which users received the compromised software package from the vendor’s distribution channels.

Context and Background

Wordfence identified the malware through its own research efforts. The security firm published the findings as a public service announcement to alert the community. The disclosure came directly from Rank Math, which acknowledged the issue with the specific plugin version. This information allows administrators to verify their installation dates against the provided timeline to determine potential exposure.

Who Is Affected

Users who updated to Rank Math SEO PRO version 3.0.123 during the specified window are the primary concern. The disclosure notes that the malware was found in downloads occurring between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Administrators who installed the plugin outside this timeframe or using different versions are not indicated as having received the malicious copy based on the current disclosure.

What should you do?

Administrators should verify the installation date of Rank Math SEO PRO version 3.0.123 on their WordPress sites. If the update occurred within the October 15 to October 16 window, immediate investigation is required. Users should check for unexpected files, unauthorized administrative accounts, or unusual outbound network connections that may indicate active compromise from the embedded malware.

What to do and how to stay safe: Rank Math

• Verify the exact timestamp of the Rank Math SEO PRO 3.0.123 installation against the disclosed window of October 15, 2026 at 20:02 UTC to October 16, 2026 at 07:12 UTC.
• Scan affected WordPress installations for unknown files or modifications added during or after the update period, focusing on the plugin directory and core WordPress files.
• Review user accounts for unauthorized administrative privileges or new users created during the timeframe when the compromised plugin might have been active.
• Monitor server logs for suspicious outbound connections or script executions that do not align with normal plugin functionality once the vendor provides an update.

Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which version of Rank Math contains the malware?

The malware was found in some copies of Rank Math SEO PRO version 3.0.123, according to the disclosure by Rank Math cited by Wordfence.

When were the compromised copies distributed?

Affected downloads occurred between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC, as stated by Rank Math.

Did Rank Math confirm the incident?

Yes, Rank Math disclosed that some copies of the plugin version contained malware, providing the specific timeframe for the affected updates.