The Exploit Bulletin — Tuesday, October 20, 2026: 1 issue requires action
Tuesday, October 20, 2026 — 1 issue requires action. If you run none of the software below, you are done.
Affects: WordPress/Rank Math PRO
1. Rank Math PRO 3.0.123 shipped backdoored from vendor's own download server
SUPPLY-CHAIN COMPROMISE · CRITICAL
The malicious build was live for an 11-hour window last week and any site that activated it should be treated as fully compromised today — waiting leaves an attacker-controlled, self-rebuilding backdoor and leaked site credentials in production.
Rank Math confirmed that downloads of Rank Math PRO v3.0.123 pulled from its official site between 2026-10-15 20:02 UTC and 2026-10-16 07:12 UTC contained malware that backdoors the WordPress site when the plugin is activated. The vendor pulled the files and released clean v3.0.124; reporting says the backdoor gives persistent access and can expose site credentials and API keys.
Affected: Rank Math PRO 3.0.123
How to Test: Check the plugin version and the file timestamps of wp-content/plugins/seo-by-rank-math-pro (and your download/update logs or WAF/CDN egress logs) for a 3.0.123 download or update between 2026-10-15 20:02 UTC and 2026-10-16 07:12 UTC; diff the installed plugin files against a clean v3.0.124 archive and scan for unexpected PHP files, new administrator users, unknown scheduled (wp-cron) tasks, modified wp-config.php/.htaccess and outbound connections from the web host.
How to Mitigate: Replace the plugin with clean Rank Math PRO v3.0.124; if 3.0.123 was activated in the window, restore the site from a backup taken before 2026-10-15, then rotate all WordPress administrator passwords, database credentials, wp-config.php salts/keys, and any API keys or tokens stored on or reachable from the host.
Evidence: BleepingComputer carrying Rank Math's advisory · SecurityWeek
Read on the web · Every past edition
The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.
Spot an error, or an exploit we missed? Reply here or email [email protected].
