Summary
- Environment: Rank Math PRO 3.0.123 for WordPress
- Operational impact: Malicious plugin files replaced with a clean release
- Financial impact: No total incident cost established in the reviewed evidence
- Record status: Developing record. Reviewed October 21, 2026; updated as evidence emerges.
What happened
Impact
Activating an affected copy could compromise a website. Downloading without installation or activation does not establish compromise. The vendor said the free WordPress.org plugin was unaffected. No affected-site total is established. [1]
Timeline
Affected download window began
The window began at 20:02 UTC.
[1]Window ended and notice published
The window ended at 07:12 UTC; the security notice was published later that day.
[1]Briefing updated
This briefing was last reviewed and updated on October 21, 2026.
Threat Group & Attack Vector
The malicious plugin could recreate a backdoor when the site received visits. How the distribution system was first compromised remains unresolved. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- T1195.002 — Compromise Software Supply Chain: malware distributed through plugin downloads. [1]
Response
Rank Math removed affected files and released 3.0.124. For activated copies, it recommended restoring a clean backup or thorough cleanup, rotating credentials and installing the clean release. [1]