Verify Rank Math SEO PRO 3.0.123 Files for Malware if Installed Oct 15-16

Website administrators who updated their Rank Math SEO PRO plugin during a narrow window in mid-October 2026 are the primary group affected by this incident. According to the vendor, Rank Math, specific copies of version 3.0.123 contained malware that was distributed through standard update mechanisms. This means that users who simply clicked to update their software during those hours may have inadvertently installed harmful code onto their servers. The disclosure identifies the specific version and timeframe to help users determine if their installation is among those potentially affected by the compromised update package.

Which version and dates are involved?

The issue is strictly limited to Rank Math SEO PRO version 3.0.123. Rank Math stated that the affected files were downloaded or installed via an update between 20:02 UTC on 15 October 2026 and 07:12 UTC on 16 October 2026. Any installation of this specific version outside of this roughly eleven-hour window is not confirmed to be compromised by this particular incident. Users who installed the plugin before 15 October or after 16 October 2026, or those using different versions of the software, are not directly implicated by this specific disclosure regarding the malicious payload found in those specific downloads.

How was the malware distributed?

The malicious code was embedded within the official update package for the plugin. According to the disclosure, users received the infected version through the standard update process. This indicates that the compromise was present in the files distributed during that specific time window. When the update was pushed, those who applied it during the stated hours received a file that included the malware. The distribution method means that the presence of the malware is tied directly to the timing of the update application rather than a vulnerability in the user's existing configuration or manual file handling.

Who reported the issue?

The presence of the malware was highlighted in a public service announcement published by Wordfence. According to Wordfence, Rank Math has disclosed the issue and provided the specific timeframes for the compromised downloads. Wordfence shared the details of the vendor's disclosure with the wider security community. This report serves to alert site owners to the potential risk associated with that specific update window, ensuring that the broader user base is aware of the incident. The information comes directly from the vendor's disclosure as reported by the security firm.

What comes next for affected sites?

Site owners must now determine whether their specific installation was affected. According to the timeline provided by Rank Math, the risk is confined to those who updated during the stated hours. There is no mention in the source material of a specific fix or patch being released yet, so users should rely on the vendor's ongoing communications. Affected users should verify the integrity of their installed files. The focus remains on confirming whether the specific version was installed during the compromised window and monitoring for any further official guidance from the plugin developer regarding remediation steps.

What affected people can do

Teams usually begin by verifying the exact timestamp of the plugin installation on their servers. Check whether the update was applied during the specified window by reviewing server logs or plugin update histories. Look for any unfamiliar files or scripts within the plugin directory that were not present in previous clean versions. Monitor administrative logs for login attempts from unusual locations or times, as attackers often use compromised plugins to gain persistent access. Be wary of follow-up emails claiming to offer a fix, as scammers frequently exploit such incidents to distribute further malware.

What to do and how to stay safe: Rank Math

• Verify the installation date of Rank Math SEO PRO 3.0.123 against the 15-16 October 2026 window to determine if your site was potentially affected.
• Scan your website files for any unexpected changes or new scripts that were added during the update process, focusing on the plugin directory.
• Review administrative access logs for any unauthorised login attempts or new user accounts created around the time of the update.
• Once the vendor provides an update, apply it immediately to replace the compromised version, but ensure you have a clean backup first.

Step-by-step guide: Endpoint Detection and Response for Small Teams

General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did Rank Math confirm that version 3.0.123 contains malware?

Yes, Rank Math disclosed that some copies of Rank Math SEO PRO version 3.0.123 contained malware.

When were the affected downloads made?

The affected version was downloaded or installed between 20:02 UTC on 15 October 2026 and 07:12 UTC on 16 October 2026.

Who first published the alert about this issue?

Wordfence published the public service announcement detailing the malware found in the Rank Math downloads.