Rank Math says PRO downloads in an 11 hour 10 minute window carried malware; no count given as of 19 October

Eleven hours and ten minutes decide which Rank Math PRO sites are affected

Rank Math says that copies of its paid plugin, Rank Math PRO version 3.0.123, downloaded between 20:02 UTC on 15 October 2026 and 07:12 UTC on 16 October 2026 contained malware. That window is 11 hours 10 minutes, or 670 minutes (derived). In UK time it opened at 21:02 BST on Thursday 15 October and closed at 08:12 BST on Friday 16 October, overnight for most UK site owners. The vendor's own notice says the affected files "contained malware that could compromise your website if the plugin was activated".

The window is the only test the vendor gives. The version number is not a test. Rank Math's changelog dates 3.0.123 to 7 October, 8 days before the window opened (derived), so a 3.0.123 copy fetched on 8 October falls outside the window and one fetched at 03:00 UTC on 16 October falls inside it, with the same label on the file. The reverse also holds. A site that took an affected copy in the window and has since moved to the clean 3.0.124 shows a clean version number, yet the notice's first case is defined by when 3.0.123 was installed and activated, not by what is installed now.

What the window does not establish is most of what an owner needs. The notice says the incident affected "a limited number of users" and gives no count. It does not say how the files reached Rank Math's download system, whether automatic updates delivered them, what the hashes of the affected and clean packages are, or why some customers may be unable to log in. The Hacker News lists several of these as unsaid. Each was checked against the notice itself, and the notice is silent on all of them. One item differs between the two copies of the notice read: the current version says the free plugin is not affected, and the copy read first did not say so.

This briefing is built from Rank Math's notice and PRO changelog, the CVE record assigned by Wordfence as the numbering authority (read on CVE.org and NVD), Patchstack's entry, WordPress.org's plugin API and checksum host, a registry record for the domain the notice tells owners to block, group.one's own pages and UK government and regulator pages. The Hacker News and SecurityWeek were read as pointers only. Wordfence's own advisory page answered with a bot challenge and was not opened, so anything that rests on it is flagged. Pages were read between 18:57 and 19:10 BST on Monday 19 October 2026. The notice and the CVE and NVD records were re-read at 19:20 BST, and the notice differed: the current version carries a note on the free plugin that the first copy did not. The CVE record and NVD status were unchanged. All of this can change within hours.

Stated and not stated: Rank Math's notice, line by line

The notice is a knowledge-base page titled "Rank Math PRO 3.0.123 Security Incident: How to Secure Your Website". Its page data give a publication time of 20:32:21 UTC on 16 October, which is 13 hours 20 minutes 21 seconds after the window closed (derived). The copy first read, at about 18:57 BST, showed a last modification at 07:47:08 UTC on 17 October. The copy re-read about 20 minutes later showed 11:31:37 UTC on 19 October, 2 days 14 hours 59 minutes 16 seconds after publication (derived). The only text difference between the two is a note on the free plugin. The page does not say what was changed or when, and why one page was served in two states within the hour is not known (a cache is one possibility, inference). The table below follows the current version and sets what the notice states against what it does not. "Not stated" means not found in the notice, read in full. It does not mean the information does not exist.

What Rank Math's notice (published 16 October 2026, last modified 19 October 2026 at 11:31 UTC in the current version) states, and what it does not. Quotations are exact.

The question	Stated	Not stated
Who is affected?	"a limited number of users who downloaded" 3.0.123 in the window. Three cases: installed and activated (treat the site as compromised); installed but never activated (delete, replace, scan); downloaded but never installed or activated (no indication of compromise from this incident alone).	A way to tell an affected copy from a clean one, other than the time it was downloaded.
How many customers?	"a limited number".	Any number, or a share of customers.
How did the files get into Rank Math's system?	"We immediately removed the affected files and released a clean version".	The route, the cause, whether Rank Math's own systems or a supplier were involved, and who did it. Patchstack's entry says the attack was against Rank Math's infrastructure, which the notice does not say.
Did automatic updates deliver copies?	The words "downloaded or updated" appear once.	Whether automatic updates, the admin updater or manual downloads carried the files. The word "automatic" does not occur in the notice.
Can a package be checked?	Checksum verification "may not be available for every plugin, particularly premium plugins". Use a clean copy from the official source.	Any hash or signature for the affected or the clean package.
Is the free plugin affected?	In the current version only, in a note: "This issue affects Rank Math PRO users only", and for the free plugin on WordPress.org "your website is not affected, and no action is needed". The copy first read did not carry the note.	How Rank Math established it, and when the note was added. The Hacker News's statement that the free plugin is not named probably reflects the earlier text (inference).
How was it found, and when were the files placed?	"We recently identified a security issue".	When and how it was found, when the files were placed, and what the 20:02 and 07:12 times mark.
Was customer account data reached?	"Some users may be unable to log in and may need to reset their account password."	Why. Whether any Rank Math account or customer data was accessed, and whether any regulator has been told.
What will change?	The team is "taking steps to reduce the risk of similar incidents in the future".	Any step.

Two readings of the wording follow, and both are inference. First, the notice's first sentence makes the download in the window the trigger, but its first case needs the plugin to be installed and activated during the period. A copy downloaded inside the window and installed after 07:12 UTC on 16 October fits none of the three cases as worded: the first needs the install in the period and the other two describe copies never installed. The notice tells anyone unsure to contact Rank Math support. Second, the CVE record describes "a subset of version 3.0.123 packages", so being inside the window is the condition the vendor names for concern, and the record does not say that every copy in the window was affected.

The window drawn to scale, and the intervals around it

On a fourteen day line the window is a sliver: 11 hours 10 minutes is 5.2 per cent of the 9 days between the two changelog dates (derived). The second panel enlarges 14 October 18:00 to 17 October 00:00 to put the other timestamps read for this briefing on the same clock.

Intervals computed from the timestamps in the sources (derived). Every start and end is quoted from a page read on 19 October 2026.

Interval (derived)	Length	From and to (source)
The window	11 h 10 min, 670 minutes	20:02 UTC on 15 Oct to 07:12 UTC on 16 Oct (the notice and the CVE record)
3.0.123 changelog date to window opening	8 days, by date	7 Oct (changelog) to 15 Oct (the notice)
The window as a share of the changelog span	5.2 per cent	670 minutes of 9 days, 7 Oct to 16 Oct (the two changelog dates)
Domain registration to window opening	24 h 30 min 46 s	19:31:14 UTC on 14 Oct (registry record) to 20:02 UTC on 15 Oct
Window opening to notice published	24 h 30 min 21 s	20:02 UTC on 15 Oct to 20:32:21 UTC on 16 Oct (notice page data)
Window closing to notice published	13 h 20 min 21 s	07:12 UTC to 20:32:21 UTC on 16 Oct (notice page data)
Window closing to CVE record published	3 d 9 h 23 min 59 s	07:12 UTC on 16 Oct to 16:35:59 UTC on 19 Oct (CVE.org)

What the intervals do and do not show. The two ends of the window are the vendor's, and the notice does not say what events they mark. A plausible reading (inference) is that the files became available at 20:02 and were removed at 07:12, but the notice says neither. The 3.0.124 changelog date, 16 October, falls inside the window, and the changelog gives no times, so the order of the clean release and the removal of the affected files cannot be set from the record.

The registry record is the most unusual item. The domain that the notice and the CVE record tell owners to block was registered at 19:31:14 UTC on 14 October, 24 hours 30 minutes 46 seconds before the window opened (derived). A registry says when, not who, and the notice does not say whether the domain was used before the window. The domain is not named here. On the dates alone it is consistent with preparation at least a day ahead (inference), and it is a dated fact a defender can search outbound logs against. The window-to-notice and registration-to-window gaps both come to about 24 hours 30 minutes. That is a coincidence of the timestamps and no pattern is claimed.

The version number, and three records that answer differently

Three records describe the same incident and give three different tests. The notice's test is the window plus whether the plugin was activated. The CVE record, whose assigner is Wordfence, carries the same caution in prose: "Only packages obtained during the vendor-confirmed window are claimed as affected; version 3.0.123 alone is not sufficient to establish compromise." Its structured field then lists the affected version as 3.0.123, with every other version marked unaffected by default, and it lists no fixed version. Patchstack's entry, as read, gives vulnerable version 3.0.123, patched in 3.0.124, priority High, CVSS 9.8, and a solution of "Update to version 3.0.124 or later". The visible entry does not mention the window.

Five copies of Rank Math PRO, what a check on the version number says, and what Rank Math's notice says. Rows 3 and 4 are this briefing's reading of the notice's wording (inference).

A site's copy	A version check says	The notice says
3.0.123 downloaded on 8 October, before the window	Affected	Outside the stated window, so not covered by the notice.
3.0.123 downloaded, installed and activated inside the window	Affected	"Treat your website as compromised" and follow the recovery steps.
The same copy, since updated to 3.0.124	Patched	The case turns on when 3.0.123 was installed and activated, so it still applies. Restore or clean, rotate credentials, and install 3.0.124 last.
3.0.123 downloaded inside the window, installed after it	Affected	Not sorted by any of the three cases as worded. Contact Rank Math support.
A fresh 3.0.124 after a clean-up	Patched	The clean version.

A scanner that matches on the version string flags rows 1 and 2 alike and clears row 3, so it is wrong in both directions. Patchstack's fix, update to 3.0.124, is the right last step and the wrong first one: the notice puts 3.0.124 last, after a restore or a clean-up, and says "Deactivating the plugin alone is not sufficient." The Hacker News attributes to Wordfence's advisory (not read here) that installing 3.0.124 does not remove files, administrator accounts or scheduled tasks the malware placed. The notice's own ordering is consistent with that.

Five labels in this story do the work of a control without being one.

Labels in the story, where each appears and what the record shows.

The label	Where it appears	What the record shows
"Version 3.0.123"	The notice's title, the CVE record's affected-version field, Patchstack's entry.	A label dated 7 October in the changelog. The exposure is the window, and the CVE record's own prose says the version alone does not establish compromise.
"Update to the clean version"	Patchstack's solution line.	The notice orders a restore or clean-up and credential changes first, and 3.0.124 last.
"Deactivate"	Common practice for a suspect plugin.	The notice: deactivating alone is not sufficient, because the malware may recreate its hidden backdoor whenever the site is visited.
"A security scan"	The notice, as a step after restore and again after the manual clean-up.	A step, not a proof. The notice also asks owners to watch whether removed files reappear.
"CVSS 9.8"	The CVE record and Patchstack's entry.	Assigned by Wordfence as the numbering authority. NVD showed the status Received and no score of its own at 17:59 UTC and again at 18:20 UTC. The vector rates network access, low complexity, no privileges and no user interaction, and none of that records that only copies from a window are in scope.

A channel the customer cannot check

Rank Math PRO is not distributed through WordPress.org. WordPress.org's plugin API answered "Plugin not found" for each of three candidate slugs for the PRO plugin, and the notice tells owners to download 3.0.124 from their account on rankmath.com. The free plugin is on WordPress.org. The table sets what a defender can check against each, as read on 19 October 2026.

What a customer can check, free plugin against PRO plugin. The WordPress.org checksum host is downloads.wordpress.org. The PRO plugin was queried under two names, seo-by-rank-math-pro and rank-math-pro.

The check	Free plugin, WordPress.org	PRO plugin, rankmath.com
A WordPress.org checksum file for the release	Present for 1.0.280, the current release, with 1,337 file entries. Also present for 1.0.279.	Not found for 3.0.123 or 3.0.124 under either name, and not found for 3.0.122 under the first name.
A plugin directory listing	Listed: 4+ million active installations, last updated 6 October 2026 at 12:43 GMT.	None. The API found no plugin under three candidate slugs.
A hash from the vendor	Not applicable.	None in the notice.
The incident in the changelog	Not applicable.	The PRO changelog lists v3.0.124 (16 October) with the same two fixes as v3.0.123 and no security item.
Named in the notice	Yes, in a note on the current version: not affected, no action needed. Not in the copy first read.	Yes.

The NCSC's guidance on updating by default says to "ensure the updates come from trusted sources, usually the vendor support website", and adds "You may be able to confirm the hash or checksum before installation." Here the trusted source is the thing that was compromised, and the check the NCSC names was not available to PRO customers: WordPress.org publishes no checksums for the PRO plugin, and the notice publishes none. The NCSC's example page on third party software providers describes the underlying problem in an industrial setting: compromised software is "very difficult to detect if it has been altered at the source", which "places great reliance on the supplier".

The free plugin is a separate matter, and the two copies of the notice read differ on it. The copy read first named only PRO and was silent on the free plugin, which is how The Hacker News describes it. The current version says the free plugin is not affected and needs no action. That is the vendor's statement, with no reason given. The independent facts agree with it: the free plugin's latest release, on 6 October at 12:43 GMT, is 9 days 7 hours 19 minutes before the window opened (derived), and it ships through WordPress.org's own channel (inference).

The Hacker News calls Rank Math part of a Swedish hosting group. group.one's own brands page lists Rank Math among its product brands, and its site footer names one.com Group AB at an address in Malmö, Sweden. group.one describes itself as a European digital infrastructure and application provider and sells WordPress hosting. The notice does not mention the group, and whether any group infrastructure was involved is not stated.

Is it a pattern? What could be checked of the earlier incidents

The Hacker News calls this at least the third time this year that a premium WordPress plugin's vendor-run update channel has delivered backdoored builds, and lists four earlier incidents. Each was checked against whatever primary page could be read. Wordfence's blog posts on the ShapedPlugin and BdThemes incidents also answered with a bot challenge and were not opened, so those two rest on other records.

Four earlier 2026 incidents, what could be read about each, and whether the route matches this one (delivery by the vendor's update channel).

Incident and month	What was read	Same route as Rank Math?
Nextend Smart Slider 3 Pro, April	Patchstack's analysis of 9 April reports Nextend's confirmation that an unauthorised party breached its update infrastructure. Version 3.5.1.35 was released on 7 April and, per Nextend, available for about 6 hours before detection.	Yes. Nextend's own advisory was not read.
ShapedPlugin Pro plugins, June	The WPScan entry (published 3 June) and CVE-2026-10735 say Pro plugins were "distributed with malicious code through the vendor's compromised update server". WPScan says there was no public vendor statement.	Yes, on that record. Wordfence's post was not opened.
OptinMonster and TrustPulse, June	OptinMonster's own notice of 14 June says tampered JavaScript was served from its content delivery network for "approximately a few hours on June 12, 2026 (UTC)", after an attacker found a network key on its marketing-site server.	No. A script fetched at run time, not a plugin package. No update was pushed.
BdThemes, August	The CVE record CVE-2026-92991 (Wordfence, 18 September) describes cross-site scripting that works if the vendor's API server is compromised. BleepingComputer of 10 August, citing Wordfence, reports a poisoned remote JSON feed and no vendor statement at that time.	No. A data feed read by the admin screen, no update.

Two of the four, Nextend and ShapedPlugin, match this incident's route, so "at least the third" holds for vendor update channels (inference from the records above). The other two altered something a site fetches from vendor infrastructure at run time, which is a different failure with a similar lesson. Nothing read links the actors behind any of them to this one. BleepingComputer says Wordfence ties the BdThemes activity to the actor behind the OptinMonster incident, which Wordfence's own post, not opened here, would have to confirm. The Hacker News says one ShapedPlugin package was later tampered with under the same version number. That was not found in what could be read, and it is left out. WPScan's ShapedPlugin page also lists, as related titles only, an August entry on Fluent Forms Pro and Ninja Tables Pro described as a backdoor via a compromised vendor update server and a June entry on MonsterInsights Pro. Those pages were not opened, so the pattern may be wider than the four listed. This site has covered the aftermath side of such incidents before: a fixed plugin does not clean a hacked site, and a backdoor that rebuilds itself.

Whose interest each source serves. Rank Math sells PRO licences, wrote the notice, and is the only source for what was in the files. Patchstack's pages carry prompts for its paid mitigation product, and the numbering authority that scored the CVE, Wordfence, is a security firm too. That does not make either wrong. The method here is to follow the vendor's page where it speaks and to say where only a security firm does.

The UK: what the guidance says and where it stops

UK clocks are on BST, one hour ahead of UTC, until Sunday 25 October 2026, so the window ran from 21:02 on Thursday 15 October to 08:12 on Friday 16 October. None of the UK pages read mentions Rank Math, WordPress or this incident. The table gives what each says, as read on 19 October 2026, and where it stops.

UK guidance and regulator pages as read on 19 October 2026, with where each stops. Quotations are short and exact.

UK source	What it says	Where it stops
NCSC, supply chain security guidance, example page "Third party software providers" (published 2019, reviewed 22 October 2025)	Compromised software altered at the source is "very difficult to detect" and "places great reliance on the supplier".	The example is industrial control software, and the collection is written for large organisations, the public sector and security professionals. It gives a small site owner no steps.
NCSC, vulnerability management, "Put in place a policy to update by default" (reviewed 1 May 2026)	Apply updates "as soon as possible, and ideally automatically". The best-practice timescale for internet-facing services and software is 5 days, installing on a test environment or backup first. Updates should come from trusted sources, usually the vendor, and you "may be able to confirm the hash or checksum".	Nothing on a poisoned vendor. Rank Math published no hash. Five days from the 7 October changelog date is 12 October, 3 days before the window (derived), if the file was available on that date, which is not stated. Early updaters were not exposed, by accident rather than design (inference).
NCSC blog, "Software supply chain attacks: check your dependencies" (4 June 2026)	"Pause automatic dependency updates where compromise may be present" and "Avoid automatically adopting new dependency versions without review", balancing patching quickly against updating slowly.	Written about open source packages and developer pipelines. WordPress and plugins are not mentioned. It is the one NCSC page read that argues for slowing updates, and it is not guidance for premium plugins.
Cyber Essentials requirements for IT infrastructure v3.3 (April 2026)	Software in scope must be licensed and supported and have "automatic updates enabled where possible". Updates that fix critical or high risk flaws, CVSS 7 or above, or flaws of unstated severity, go on within 14 days.	Nothing on where an update came from. The words checksum, integrity, provenance and supply chain do not appear in the document, and code signing appears only in the malware protection section. The 3.0.123 changelog lists two bug fixes, so the 14 day clock does not obviously apply. A certificate says nothing about a poisoned vendor.
Software Security Code of Practice, DSIT and NCSC (voluntary, updated 15 January 2026)	Aimed at software vendors. Principle 2.1 "Protect the build environment against unauthorised access", 2.2 "Control and log changes to the build environment", 3.1 "Distribute software securely to customers", 4.3 "Make information available to customers about notable incidents" that may cause significant impact.	Voluntary, and framed for business-to-business sales of proprietary software. Whether a plugin sold to site owners is in scope is not stated. A certification scheme is described as being developed. It gives customers questions to ask, not a remedy.
ICO, personal data breach reporting and "Personal data breaches: a guide"	Report a notifiable breach "not later than 72 hours after becoming aware of it", with details to follow if needed. Access by an unauthorised third party is a personal data breach. A processor must inform the controller without undue delay. Consider the NCSC if a malicious actor caused it. The ICO's reporting page says it is under review after the Data (Use and Access) Act.	Does not say when a customer of a poisoned vendor becomes aware. It points to EU Article 29 Working Party guidelines for that, which were not read here.

An illustration, not advice. If a controller treated the moment the notice was published as the moment it became aware, 72 hours from 20:32 UTC on 16 October ends at 20:32 UTC on 19 October, which is 21:32 BST on Monday (derived). At about 19:20 BST, when this was written, that was a little over two hours away. Awareness is a judgement on the facts, the ICO expects early notice with details later, and whether a given site held personal data that was reachable is the question that decides everything else. A site with no personal data and no reachable secrets may have nothing to report.

Agencies and hosts matter here. The ICO's guide says that if a processor suffers a breach it "must inform you without undue delay as soon as it becomes aware". An agency that runs clients' WordPress sites with Rank Math PRO may well be a processor for those clients (that depends on the contract), and then the question is how fast it can tell each client which sites held an affected copy. The NIS Regulations 2018 are not covered: no record read ties this incident to a listed essential service.

What to do, in the order worth doing

Everything below rests on the notice, the CVE record or the UK pages above. The vendor's list of indicators is in its notice and is deliberately not reproduced here. Item 12 is this briefing's suggestion and not guidance from the NCSC.

What could not be verified

• Wordfence's advisory. Its page sat behind a bot challenge and was not opened or bypassed. Its date (The Hacker News says 17 October) and its statement that installing 3.0.124 leaves files, accounts and scheduled tasks in place rest on The Hacker News. Wordfence's role as the CVE numbering authority and the 9.8 score were read in the CVE record itself.
• How many customers, how the files entered, whether automatic updates delivered them, and the package hashes. Not stated by Rank Math.
• What the window ends mark. The notice does not say whether they are the times the files were available.
• The free plugin. The notice's current version says it is not affected. The copy read first did not, and the reason and the time the note was added are not stated. The release date and channel agree with it.
• The earlier incidents. Nextend's own advisory, Wordfence's posts on ShapedPlugin and BdThemes, and WPScan's other titles were not read. The Hacker News claim about a ShapedPlugin package tampered under the same version number was not found and is left out.
• The group. group.one's pages show Rank Math as a product brand and a Swedish company in the footer. Whether group infrastructure was involved is not stated.
• The registry record. It dates the registration and says nothing about who registered it or whether it was used before 15 October.
• Time-stamped. Read between 18:57 and 19:10 BST on 19 October 2026 and re-read at 19:20 BST. The notice was last modified at 11:31:37 UTC on 19 October as re-read (07:47:08 UTC on 17 October in the copy first read), and the NVD record was in the status Received both times.

The question that exposes the gap

Rank Math can tell which accounts downloaded 3.0.123 in an 11 hour 10 minute window. How many customers received an affected copy, has each of them been told, and how would a customer who was not emailed ever find out?

Key facts