Rank Math says copies of its PRO plugin version 3.0.123 downloaded between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, and it has released a clean version, 3.0.124.
In its security incident notice, the company says the issue affected a limited number of users who downloaded the PRO release in that window. It says it removed the affected files immediately. The free Rank Math SEO plugin from WordPress.org is not affected and needs no action.
The notice sorts site owners into three cases. A site that installed and activated 3.0.123 during the window should be treated as compromised. A site that installed it without activating should delete the plugin files, install 3.0.124 from the Rank Math account and run a security scan. A copy that was downloaded and never installed shows no indication of compromise from this incident alone.
The recovery guidance has one ordering rule: stop the malware from rebuilding itself before deleting anything else. Rank Math says the malware can recreate its hidden backdoor whenever someone visits the site, and that deactivating the plugin is not sufficient, so the whole rank-math-pro folder has to go. It recommends restoring a backup taken before 20:02 UTC on October 15 where one exists, blocking outgoing connections to rank1cdn.com, checking for unfamiliar administrator accounts, and changing all passwords, database credentials, API keys and WordPress salts, on the assumption that secrets on the site were exposed.
The incident belongs with other cases where software people trusted carried the problem, such as GhostAction’s sweep of 345 repositories through two maintainer accounts and the ConnectWise cloud backup suspension. WordPress operators can keep a record of when each paid plugin was last installed or updated, so a notice like this one can be matched against a timestamp in minutes.
Source: Rank Math, PRO 3.0.123 Security Incident: How to Secure Your Website
