Rank Math PRO Incident: Verify Site Recovery

Rank Math says some PRO 3.0.123 downloads contained malware during the window from 2026-10-15T20:02:00Z to 2026-10-16T07:12:00Z. Its official incident advisory identifies PRO 3.0.124 as the clean replacement and tells owners who activated an affected installation to treat their website as compromised.

For a business owner, the important question is therefore not just which plugin version appears today. It is whether the affected package ran, what recovery covered, and what evidence supports closing the incident. Ask your maintenance provider to separate those answers rather than report only that the plugin is updated.

Establish what happened before accepting an all-clear

Start in the WordPress admin area's Plugins screen to check the installed Rank Math PRO version. Then ask whoever manages updates to establish the download, installation and activation history. Rank Math's decision guidance distinguishes three situations:

• Affected version installed and activated: treat the website as compromised and follow the recovery instructions.
• Affected version installed but never activated: delete the affected plugin files, install clean PRO 3.0.124 and run a precautionary security scan.
• Affected version downloaded but not installed or activated: the vendor says this incident alone does not indicate website compromise.

Record which branch applies and what supports that conclusion. Do not substitute the current version for historical evidence. If installation or activation cannot be established, mark it unresolved and contact Rank Math support; the advisory explicitly offers help for uncertain cases.

The free Rank Math SEO plugin distributed through WordPress.org was not affected by this malware incident, according to the vendor. Do not apply the PRO compromise finding to every site using Rank Math.

Separate a clean package from a recovered website

The clean release addresses the affected plugin package. Recovery addresses what may have happened after activation. Rank Math warns that the malware can recreate a hidden backdoor when someone visits the site, and that deactivating the plugin alone is insufficient.

BleepingComputer's independent report also distinguishes updating the plugin from removing the threat after compromise. Its reporting describes the incident as a supply-chain attack involving downloads from the vendor's official website.

For sign-off, request two separate entries: confirmation that the clean package was installed, and a recovery record covering restoration or cleanup, credential replacement and verification. Treat this as an evidence checklist derived from the vendor's recovery requirements, not an additional vendor certification scheme.

A screenshot of PRO 3.0.124 answers the package question. Ask for the remaining recovery evidence before accepting it as the incident's final status.

Ask for the backup's timestamp and restoration scope

For an activated affected installation, Rank Math's recommended recovery option is restoring both website files and the database from a clean backup created before 2026-10-15T20:02:00Z. The advisory also calls for a security scan, credential changes and installation of the clean plugin after restoration.

Ask the hosting or maintenance provider to document:

1. The selected backup's UTC timestamp and why it is considered clean.
2. Whether the restoration included both files and the database.
3. The security scan performed after restoration and its findings.
4. The credential-replacement work completed.
5. Confirmation that the clean Rank Math PRO package was installed afterward.

Avoid accepting a vague statement such as “backup restored” without its scope. Both website and database restoration are explicit parts of the vendor's instructions. If you cannot establish a suitable backup, ask the provider to explain the alternative cleanup plan rather than quietly omit that requirement.

Require a cleanup review beyond the plugin folder

When a clean backup is unavailable, Rank Math provides a manual recovery procedure and recommends involving the hosting provider or a qualified security professional if the owner is unfamiliar with files, databases or server settings.

Its manual cleanup instructions require disabling the mechanism that rebuilds the malware before removing other malicious changes. They cover deleting the affected plugin folder, removing the malicious database entry and blocking the identified outbound destination where supported. Ask the responder to use the current advisory for exact indicators and ordering, rather than improvise from a shortened checklist.

The review must also consider unauthorized administrators, modified core files, other plugins and themes, uploads, server configuration and scheduled tasks. Rank Math warns that changes may extend outside the WordPress installation. Shared-hosting customers should ask their host to inspect areas they cannot access themselves.

For your recovery record, request the areas examined, findings resolved and any areas still outside the responder's access. An explicit limitation is more useful than an unsupported claim that everything was checked. This is a provider-review checklist, not a do-it-yourself database deletion guide.

Confirm credential replacement without collecting secrets

Restoring a backup does not remove the vendor's requirement to replace potentially exposed credentials. Rank Math instructs owners to assume secrets accessible to the compromised website may have been exposed, even when recovery uses a backup.

Its credential review covers WordPress passwords, database credentials, WordPress security keys and salts, payment and other service credentials, hosting and server access, and secrets in environment variables. It also calls for reviewing administrator two-factor authentication and resetting it where necessary.

Ask for a completion record by credential category, not the replacement values. Include whether the website configuration and connected services were updated wherever required, as the vendor directs.

For documentation, use only status labels such as completed, not applicable or unresolved. Keep secret values out of the incident report, chat and committed configuration. The recovery checklist should record completion status, not replacement credentials.

Verify integrity and assign follow-up monitoring

Rank Math's post-cleanup verification guidance calls for a reputable security scan, WordPress core checksum verification and installed-plugin checksum verification. It cautions that checksums may not be available for every plugin, especially premium products; use clean copies from official sources where checksums are unavailable.

Request the verification results, including exceptions, rather than only the name of the scanning tool. Also assign someone to monitor outgoing connections and suspicious activity over the following days, and to check whether removed files reappear. These are explicit vendor recommendations, not a guarantee that one scan proves complete recovery.

If suspicious files return or unusual activity appears, Rank Math says cleanup may be incomplete and recommends further investigation with the host or a security professional. Keep that escalation condition in the handover. Do not close an unresolved finding merely because the Plugins screen shows the clean release.

Keep account recovery and unverified claims separate

Rank Math also reports that its response included a system refresh that removed some free accounts. It says the free plugin continues working and existing SEO settings, metadata and content are unaffected, although connected features require account recreation and reconnection. That account issue is distinct from the PRO malware recovery process. Follow the official account guidance and navigate to the vendor directly rather than trust unsolicited download or reset messages.

The fetched vendor advisory does not supply a CVE identifier or CVSS severity score for this incident. Those details are not verified here. This is a vendor-confirmed compromised-package incident, not a claim about a separately verified CVE. BleepingComputer also could not confirm that a malware sample it examined was distributed through the plugin; its sample-specific capabilities should not become assumed findings about your site.

For business sign-off, require an exposure decision, a documented recovery method, credential-replacement status and verification with follow-up ownership. If recovery needs wider site work, discuss that scope through website development; keep any subsequent technical SEO review separate from the security recovery decision. A clean version matters, but the recovery record is what answers the owner's harder questions.