Trusted Rank Math downloads planted persistent website backdoors
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Tuesday, October 20th, 2026.
Some Rank Math PRO downloads from the vendor’s official website contained malware during an 11-hour window. Sites that installed and activated the affected version could receive persistent backdoors that reappeared when someone visited the infected website. The vendor removed the compromised files and released clean version 3.0.124. The free edition distributed through WordPress.org was not affected.
For leaders, a compromised website can expose database credentials, A P I keys, cloud credentials, and other secrets available to the web server. For defenders, simply updating or deactivating the plugin won’t remove a backdoor that is already present. Affected sites need restoration from a known-clean backup or careful manual removal of malicious files, database entries, unauthorized administrator accounts, and scheduled tasks. The number of affected sites and the method used to compromise the vendor remain unknown.
Treat every site that activated Rank Math PRO 3.0.123 during the reported window as compromised. Clean the full environment and rotate every secret the web server could access.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
