WordPress in October: an official update carrying malware and exploited plugins, what to check

WordPress is the most widely used system for SME websites, in Ticino too. The basic rule for keeping it safe is well known: install updates as soon as they come out. In mid-October 2026, however, the opposite of what you would expect happened: for a few hours, it was an official update that brought malware onto websites.

The case concerns Rank Math SEO PRO, the paid version of a widely used SEO plugin. In the same weeks, critical flaws in WordPress core and in several plugins were fixed, some of them already exploited. Below are the verified facts and a checklist for anyone who runs a WordPress site or has a provider manage it.

What happened with Rank Math PRO

According to the vendor's advisory, a limited number of users who downloaded Rank Math PRO 3.0.123 between 15 October 2026 at 22:02 and 16 October at 09:12 (Swiss time; 20:02-07:12 UTC) received plugin files containing malware. The tampered copies came through the official distribution channel: both downloads and plugin updates were affected. Rank Math removed the files and released the clean version 3.0.124 on 16 October, as shown in its changelog.

If the plugin was activated, the malware could open persistent access to the site, recreate hidden backdoors on every visit, create administrator accounts and expose credentials stored on the server: database, API keys, payment and mail credentials. The case was assigned CVE-2026-111862, with a score of 9.8 out of 10. The vendor's advisory does not say how many sites were affected or how the tampered files entered the distribution channel.

According to the vendor, the free version of Rank Math SEO distributed on WordPress.org is not affected.

Why this case is different

Usually the problem is an old version: you update and the flaw is closed. Here the version number alone tells you nothing. A copy of 3.0.123 downloaded before or after the eleven-hour window is clean; what matters is when it was downloaded and whether it was activated. Above all, moving to 3.0.124 does not remove what the malware has already installed: added accounts, hidden files, scheduled tasks and credentials already read remain.

Rank Math distinguishes three situations:

• Version 3.0.123 installed and activated during the window: treat the site as compromised.
• Installed but never activated: delete the plugin files, install 3.0.124 from your Rank Math account and run a security scan.
• Only downloaded, not installed: according to the vendor there is no indication of compromise from this incident.

The other WordPress flaws of recent weeks

The Rank Math case is not isolated. Between September and October 2026:

• WordPress core: version 7.1.2 of 22 September fixed a critical flaw (CVE-2026-87902) that, in certain server and theme configurations, allows code execution without logging in. According to Patchstack, quoted by BleepingComputer, the first exploitation attempts came less than five hours after the fix. On 6 October, version 7.1.3 followed with seven security fixes; it is the current version at the date of this article. The fix was also backported to older branches, down to 4.7.
• Bricksforge, a paid add-on for the Bricks page builder: a critical flaw that allows uploading and running code without logging in, exploited since 7 October according to Patchstack. Fixed in 3.1.8.10.
• Ninja Forms and WPC Product Bundles for WooCommerce: flaws used in a campaign, limited so far, that installed a fake plugin and created administrators (BleepingComputer). Fixed in versions 3.15.4 and 8.6.7.
• The Grid (up to 2.8.1, fixed in 2.8.2), Theme My Login (up to 7.2.1, fixed in 7.2.2, only some multisite installations affected) and MailOptin (up to 1.2.78.6, fixed in 1.2.78.7): critical flaws exploitable without logging in, which Patchstack lists as known to be exploited.

A practical point: Rank Math PRO, Bricksforge and The Grid are paid plugins. They do not appear in WordPress.org update checks and their files cannot be compared against public checksums. Updates only come through the vendor's channel, and these are often the plugins that fall behind.

What to do now

1. Take inventory

For each WordPress site, note the WordPress version and the list of plugins with their versions, separating free from paid ones. If a provider manages the site, ask for this list in writing.

2. Rank Math PRO: establish when 3.0.123 arrived

If you use Rank Math PRO, check whether 3.0.123 was installed between 15 October at 22:02 and 16 October at 09:12, for example from the update log, the file dates or the notice received from the vendor. If it was activated during that window, follow the advisory: the recommended recovery is a full restore (files and database) from a backup made before the window began, followed by changing all credentials. Manual cleanup is possible, but it must follow the order set out by the vendor and is best done by a professional or the hosting provider. Deactivating the plugin is not enough.

3. Change credentials, even after a restore

Rank Math considers this step essential even after a restore: WordPress user passwords, the database password, WordPress security keys, API keys, mail and payment credentials, hosting, FTP/SFTP and SSH access. Then check multi-factor authentication for administrators (see the five levels of login security from the FOCS).

4. Update everything else

Bring WordPress to 7.1.3 and the plugins mentioned at least to the fixed versions. Where an update is not possible right away, deactivate the plugin. After updating, check the list of administrators and recent password and email changes: the update closes the flaw but does not undo access that has already happened. Also check the server's PHP version, after last week's PHP vulnerabilities.

5. Keep backups and an update log

This case shows the value of two simple things: daily backups kept for at least a few weeks, which let you return to a state before a specific date, and a log of when each plugin was updated. Without them, it is hard to answer the question "was our site exposed?".

6. Be wary of "security" emails

Rank Math states that it never sends login or download links by email. After incidents like this, fake notices often circulate asking people to download a "fixed version": only download updates by going directly to the vendor's website.

Reporting obligations in Switzerland

A compromised WordPress site can expose customer data, for example contact forms, orders or user accounts:

• Data protection (revFADP): a data security breach that is likely to result in a high risk for the persons concerned must be reported as soon as possible to the Federal Data Protection and Information Commissioner (FDPIC), under Art. 24 FADP. The FDPIC provides an online form.
• Critical infrastructure: since 1 April 2025, operators of critical infrastructure, including cantonal and municipal administrations, must report cyberattacks to the FOCS within 24 hours of discovery.
• For other companies, reporting to the FOCS is voluntary, but it helps assess the case.

The "SME Cybersecurity 2026" study showed that organisational preparation is the weak point of many SMEs: knowing who manages the website, where the backups are and who decides in an incident.

Frequently asked questions

I use the free version of Rank Math: do I need to do anything?

According to the vendor, no: the incident only concerns Rank Math PRO. The usual updates for WordPress and other plugins still apply.

I have already updated to 3.0.124: am I fine?

Only if the tampered 3.0.123 was never activated. If it was, the update replaces the plugin but does not remove what the malware installed: you need a restore from backup or a full cleanup, and new credentials.

Are automatic updates still a good idea?

Yes. A site running old versions remains exposed to the exploited flaws listed above, which are far more common than a tampered update. They are best combined with regular backups and an update log.

An agency manages my site: what should I ask?

Ask in writing whether the site uses Rank Math PRO or one of the plugins mentioned, when they were updated, whether there are backups from before 15 October and whether accounts and files have been checked.

Our approach

ElaraTeq Sagl builds and manages websites and applications for SMEs and public bodies in Ticino, with hosting in Switzerland. We can review your WordPress site, update core and plugins, check accounts and files, and set up backups and an update log. For ongoing management there is the service described in Orbit; for a review, contact us.

Sources

• Rank Math, "Rank Math PRO 3.0.123 Security Incident: How to Secure Your Website", October 2026: rankmath.com; Rank Math PRO changelog: v3.0.124 of 16 October 2026
• CVE Program, CVE-2026-111862 (published 19 October 2026)
• BleepingComputer, 19 October 2026: WordPress SEO plugin Rank Math compromised to backdoor websites; SecurityWeek, 19 October 2026: Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack
• WordPress.org, WordPress 7.1.2 Release, 22 September 2026; WordPress 7.1.3 Maintenance and Security Release, 6 October 2026
• BleepingComputer, 23 September 2026: Hackers start exploiting critical WordPress flaw for code execution
• Patchstack, 8 October 2026: Critical Unauthenticated Arbitrary File Upload Vulnerability Exploited in Bricksforge Plugin; BleepingComputer, 6 October 2026: Ninja Forms plugin flaw exploited to hack WordPress sites
• Patchstack, vulnerability entries: The Grid, Theme My Login, MailOptin; CVE Program, CVE-2026-89079 (Theme My Login)
• FDPIC, Reporting data security breaches; FOCS, Reporting obligation for cyberattacks on critical infrastructure