Executive Summary
Rank Math PRO version 3.0.123 was compromised in a supply chain attack between October 15 and October 16, 2026. Malicious code was embedded in the plugin packages, leading to the installation of persistent, self-rebuilding backdoors on affected WordPress websites. While the free version of the plugin remains unaffected, users of the PRO version who installed or updated during this window are at high risk of persistent compromise.
The malware exhibits 'self-healing' properties, where deleted PHP components are automatically restored by other active malicious processes or database entries. This persistence mechanism makes manual cleanup difficult, as simply updating or deactivating the plugin is insufficient to remove the threat. The attack results in unauthorized administrative access and potential exposure of all site-accessible secrets.
Immediate action is required for affected organizations: websites should be restored from a clean backup prior to October 15, 2026, followed by a mandatory update to version 3.0.124 and a comprehensive rotation of all credentials including database keys, API tokens, and administrative passwords.