---
title: "Rank Math PRO plugin malware incident"
description: "Rank Math confirmed malware in PRO plugin downloads distributed during an October 15–16 window."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-21"
canonical_url: "https://www.ally.security/incidents/rank-math-pro-plugin-malware-2026"
markdown_url: "https://www.ally.security/incidents/rank-math-pro-plugin-malware-2026.md"
stix_url: "https://www.ally.security/incidents/rank-math-pro-plugin-malware-2026/stix.json"
---

# Rank Math PRO plugin malware incident

Activating affected Rank Math PRO copies could compromise WordPress websites.

Last modified Oct 21, 2026 · 1 source

## Summary

- **Environment:** Rank Math PRO 3.0.123 for WordPress
- **Operational impact:** Malicious plugin files replaced with a clean release
- **Financial impact:** No total incident cost established in the reviewed evidence

## What happened

[Rank Math](https://rankmath.com/) confirmed malware in PRO 3.0.123 downloads distributed from October 15, 2026 at 20:02 UTC through October 16 at 07:12 UTC. [1](#source-1)

## Impact

Activating an affected copy could compromise a website. Downloading without installation or activation does not establish compromise. The vendor said the free WordPress.org plugin was unaffected. No affected-site total is established. [1](#source-1)

## Timeline

### October 15, 2026 — Affected download window began

The window began at 20:02 UTC. [1](#source-1)

### October 16, 2026 — Window ended and notice published

The window ended at 07:12 UTC; the [security notice](https://rankmath.com/kb/pro-3-0-123-security-incident/) was published later that day. [1](#source-1)

### October 21, 2026 — Briefing updated

This briefing was last reviewed and updated on October 21, 2026.

## Threat Group & Attack Vector

The malicious plugin could recreate a backdoor when the site received visits. How the distribution system was first compromised remains unresolved. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- [T1195.002 — Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/): malware distributed through plugin downloads. [1](#source-1)

## Response

Rank Math removed affected files and released 3.0.124. For activated copies, it recommended restoring a clean backup or thorough cleanup, rotating credentials and installing the clean release. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/rank-math-pro-plugin-malware-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Rank Math PRO 3.0.123 Security Incident: How to Secure Your Website

official · Rank Math · Oct 16, 2026

<https://rankmath.com/kb/pro-3-0-123-security-incident/>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Rank Math PRO plugin malware incident: Affected distribution window began
2. **Resulted In · 100% confidence · current**  
   Rank Math PRO plugin malware incident: The vendor said the free Rank Math SEO plugin on WordPress.org was not affected by this incident.
3. **Resulted In · 100% confidence · current**  
   Rank Math PRO plugin malware incident: Affected distribution window ended and notice published
4. **Used Attack Technique · 100% confidence · current**  
   Rank Math PRO plugin malware incident: https://attack.mitre.org/techniques/T1195/002/
5. **Occurred At · 100% confidence · current**  
   Affected distribution window began: 2026-10-15
6. **Occurred At · 100% confidence · current**  
   Affected distribution window ended and notice published: 2026-10-16
7. **Resulted In · 100% confidence · current**  
   Rank Math PRO plugin malware incident: Activating the affected plugin could compromise a website; downloading without installation or activation does not by itself establish website compromise.
8. **Disclosed At · 100% confidence · current**  
   Rank Math PRO plugin malware incident: 2026-10-16
9. **Affected Organization · 100% confidence · current**  
   Rank Math PRO plugin malware incident: Rank Math
10. **Resulted In · 100% confidence · current**  
   Rank Math PRO plugin malware incident: The malware could recreate a hidden backdoor when the website received visits, making removal of individual files insufficient.
11. **Resulted In · 100% confidence · current**  
   Rank Math PRO plugin malware incident: For activated copies, Rank Math recommended restoring a clean backup or a thorough cleanup, replacing credentials and then installing the clean release.
12. **Resulted In · 100% confidence · current**  
   Rank Math PRO plugin malware incident: Rank Math removed the affected files and released clean version 3.0.124.
13. **Resulted In · 100% confidence · current**  
   Rank Math PRO plugin malware incident: Rank Math confirmed malware in PRO version 3.0.123 downloads supplied between October 15 at 20:02 UTC and October 16 at 07:12 UTC.

</details>