Rank Math PRO 3.0.123 downloads from the vendor's own site carried a backdoor

PRO packages downloaded in an 11-hour window were malicious

Rank Math said a security problem hit a limited group of people who fetched PRO version 3.0.123 between 20:02 UTC on October 15, 2026 and 07:12 UTC on October 16, 2026. According to the company, the affected plugin files held malware able to take over a site if the plugin was activated. BleepingComputer describes a supply-chain attack in which some downloads from the vendor's official website planted hidden backdoors, and it puts the window at about 11 hours.

Rank Math says it pulled the affected files immediately and published a clean build, 3.0.124. Both BleepingComputer and SecurityWeek covered the incident on October 19, 2026, with the same version and time window. Only the PRO edition is involved: the free Rank Math SEO plugin on WordPress.org was not affected, and BleepingComputer notes that the free plugin is active on more than 4 million sites. As part of its response, though, Rank Math refreshed its systems on rankmath.com, which deleted free accounts created from October 13 to 16, 2026; affected users were emailed and need to recreate their account to restore account-linked features such as Search Console data and the AI tools.

The malware keeps access and rebuilds its own backdoor

Rank Math says the malware sets up persistent access, talks to the domain rank1cdn.com and can recreate its hidden backdoors whenever someone visits the infected site. Sites that ran the build face exposure of database credentials, API keys and other secrets the web server can reach. The vendor's page also lists a fake WordPress core file (wp-includes/class-wp-cache-util.php), administrator accounts whose names start with wpsupport_, .cache files that .htaccess rules let run as PHP, and suspicious scheduled tasks among the traces to look for.

The recommended route depends on what a site did with the file. Those who installed and activated 3.0.123 in the window should treat the site as compromised, and Rank Math's preferred fix is restoring a clean backup taken before 20:02 UTC on October 15, scanning, changing all passwords and credentials, and then downloading 3.0.124 from the account. Without a backup, manual cleanup applies and the order matters: first delete the whole rank-math-pro folder and the malicious database entries in the wp_options table, and block rank1cdn.com connections if possible. In the vendor's words, "Deactivating the plugin alone is not sufficient." Those who installed the version but never activated it should delete it, download 3.0.124 and scan the site.

An update from the official channel can still be an attack path

An SEO plugin is broad, powerful software that runs on every page. That makes this attack unlike an ordinary plugin bug: users were not fooled by a fake site, they downloaded from the vendor's own. Cleanup is also awkward, since the malware can rebuild its backdoor on a visit, so that mechanism has to be stopped before files are removed. Rank Math asks for every password, database credential, WordPress salt and key, API key and hosting or SSH access to be rotated, even after restoring from a backup.

The company also says it will never email download or login links, and for the clean build it tells users to go to rankmath.com directly. BleepingComputer asked Rank Math how many sites were affected and how the attackers first got in, and had no reply by the time of publication. The same article describes a PHP sample on VirusTotal that carries the same indicators, though it could not confirm that the file was distributed through the plugin.

The sources say nothing about Türkiye, so this section is commentary

None of the three sources mentions Türkiye, Turkish users or any local body. This section is therefore not a fact drawn from the sources but explicitly UNALSOFT commentary. The unknowns, one by one: how many sites in Türkiye were affected, whether local hosting companies downloaded the package, and whether a Turkish regulator or national cybersecurity body will respond are not covered in the reporting.

Our reading is that Rank Math represents a class of plugin that may be common on small business sites in Türkiye too, and every site running the PRO edition should check its own version history. If the admin panel shows 3.0.123 and activation fell inside the window, the steps in the reporting apply. We covered a related cleanup topic on October 1, and that article is independent of this incident.

Sources

Rank Math, PRO 3.0.123 security incident and how to secure your website · BleepingComputer, Rank Math compromised to backdoor websites · SecurityWeek, Rank Math PRO compromised in supply chain attack