Some copies of Rank Math SEO PRO version 3.0.123 contained malware. Rank Math has disclosed the problem, and Wordfence has rated it critical, with a CVSS score of 9.8 out of 10.
Who is affected
Rank Math says the bad copies were downloaded or installed through an update between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Only users who got version 3.0.123 in that window are in scope.
Having 3.0.123 does not prove your site was hacked. But if an affected copy was active on your site, treat the site as compromised.
What to do
Rank Math removed the affected files and released version 3.0.124 as the clean replacement. Update to it.
Updating alone is not enough. According to Wordfence, the malware may have left extra files, administrator accounts, or scheduled tasks elsewhere on your server.
- Check when version 3.0.123 was downloaded or installed on your site.
- If it falls inside the window above, review your administrator accounts and remove any you do not recognize.
- Look for unfamiliar files and scheduled tasks, or ask your host or a security professional to do it.
- Follow the recovery steps in Wordfence’s write-up and Rank Math’s own security notice, which Wordfence calls the authoritative source for updates.
This affects Rank Math SEO PRO, the paid version. Wordfence lists the plugin as seo-by-rank-math-pro and tracks the issue as CVE-2026-111862.
End of article