Self-Restoring Backdoor

Rank Math PRO WordPress Plugin Compromised with Self-Restoring Backdoor

Rank Math, the developer of the popular Rank Math PRO and Rank Math SEO WordPress plugins, confirmed that plugin copies distributed via rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026, were compromised with malware. The company stated that any site installing one of these compromised copies should be treated as compromised. The malware includes a self-restoring backdoor mechanism that may persist even after plugin removal if not fully cleaned. Rank Math has released a fix and is advising users to update to the latest version from official sources and perform full site scans.