Rank Math PRO WordPress plugin hit by supply chain attack

Rank Math PRO was compromised in a supply chain attack: version 3.0.123 packages contained malware that could let attackers take over sites once the plugin was activated. Users who downloaded or updated the plugin between October 15, 2026, 20:02 UTC and October 16, 2026, 07:12 UTC may be infected; a clean v3.0.124 has been released.

• Malicious code was found in Rank Math PRO 3.0.123 packages
• Infection window: Oct 15, 20:02 UTC to Oct 16, 07:12 UTC
• Clean release is Rank Math PRO v3.0.124
• Malware recreates a hidden backdoor on each page visit