The window

The same version number did not mean the same file

Rank Math says a limited number of users received malware in PRO v3.0.123 downloaded between 15 October at 20:02 UTC and 16 October at 07:12 UTC. The company removed the affected files and released clean v3.0.124. The free plugin distributed through WordPress.org is not part of this incident.

The vendor makes an important distinction. Downloading the package alone is not evidence that a website was compromised. Installing but never activating it calls for deleting the affected files, installing the clean release and scanning. A site that activated the affected package during the window should be treated as compromised.

An update is not cleanup

Rank Math says the malware can recreate a hidden backdoor when a visitor loads the site. Deactivating or replacing the plugin without removing its persistence can leave attacker access behind.

Defender workflow

Recover the site, then recover the secrets

  1. 1

    Establish exposure. Check plugin-install records, downloaded files, deployment history and activation time. Record the site and database state before cleanup if an investigation is needed.

  2. 2

    Use a clean recovery path. For activated sites, Rank Math recommends restoring website files and database from a backup created before 15 October at 20:02 UTC. If that is impossible, follow its ordered manual-cleanup guide; removing random suspicious files first can miss the mechanism that recreates them.

  3. 3

    Look beyond the plugin. Check for unexpected administrator accounts, modified PHP files, database entries and scheduled tasks. Rotate site passwords, database credentials, API keys and other secrets accessible to the web server, then install the clean PRO release.

Defender note

Close this as an incident, not a maintenance ticket

The closure evidence should show which sites used the affected package, whether it ran, what was restored or removed, which credentials were rotated, and what scanning or log review found afterward. A dashboard showing v3.0.124 is useful, but it does not answer those questions.