Rank Math PRO Plugin Infected with Malware

The SEO plugin Rank Math PRO for WordPress was infected with malware between October 15, 2026, at 20:02 UTC and October 16, 2026, at 07:12 UTC. This was announced by Rank Math in a security notice published on October 16, 2026.

The infected versions were either downloaded directly from rankmath.com or provided as updates. Rank Math warned that any website that has installed and activated one of these compromised versions should be considered at risk. The malware allows attackers to install a self-repairing backdoor, enabling them to take control of the affected websites. The security notice from Rank Math includes specific instructions for affected users. They should immediately check their installations and uninstall the compromised versions if necessary.

Rank Math recommends updating to the latest secure version of the plugin to close the security vulnerability. The exact number of affected websites has not been disclosed; however, it is known that Rank Math PRO is a widely used solution for search engine optimization. The plugin installation is popular among many WordPress users, increasing the potential reach of the malware. The security vulnerability could have significant impacts on the affected websites, especially if sensitive data or user information is involved. Rank Math has emphasized that user security is a top priority and is working to address the security issues.

The malware was identified as part of an attack aimed at gaining control over WordPress websites. Experts recommend that website operators regularly check their plugins and themes for security updates to avoid similar incidents in the future. The security warning from Rank Math comes at a time when cyberattacks on web applications are increasing. According to the Cybersecurity & Infrastructure Security Agency (CISA), attacks on content management systems like WordPress are particularly common, as they are often not adequately secured. Rank Math has announced that they will provide further information on addressing the security issues.

Users affected by the malware should immediately contact Rank Math support for assistance. The security vulnerability and associated risks highlight the need for website operators to take proactive measures to secure their systems. The use of security plugins and regular backups are recommended practices to minimize the impact of such attacks. Rank Math has stressed in its announcement that the affected versions of the plugin should no longer be used. Users should ensure that they have the latest version of the plugin installed to protect their websites.

The security warning has been picked up by numerous security researchers and IT experts, who emphasize the importance of cybersecurity in today’s digital landscape. The incidents demonstrate how crucial it is to install security updates promptly and monitor websites for suspicious activities. The affected versions of the Rank Math PRO plugin are versions 1.0.0 to 1.0.3. Users should uninstall these versions immediately and update to the latest version to protect their websites. Rank Math has announced that they aim to fully close the security vulnerability by October 30, 2026.