Rank Math: Evidence and scope
Expanded web report · Related PDF snapshot: 22 October 2026 · PDF page 14
Research reviewed 22 October 2026 · Evidence and editorial planning guidance are distinguished below.
What the source establishes
Rank Math identifies a malicious PRO 3.0.123 distribution window and distinguishes downloading from activating the package. Its recovery guidance goes beyond updating the plugin: affected activated installations require a trusted recovery process. The free WordPress.org plugin is outside this specific malware distribution scope.
Research reviewed 22 October 2026: Rank Math PRO 3.0.123 incident guidance. Vendor plugin advisory revisited.
Where the evidence stops
Do not equate all Rank Math installations with affected sites, or assume a clean replacement plugin removes changes already made elsewhere on a site.
Use this report as a dated interpretation. A vendor notice establishes what that vendor reports; a research observation establishes what the researcher observed. Neither automatically answers the account-specific question for your business. Record later changes to the source before relying on its versions, deadlines or recovery sequence.
Establish your own scope
Establish the installed edition, artifact timing and activation evidence. Review site files, database changes, administrator accounts and the authority available to the web application.
- Identify the exact service, artifact, account or device relevant to your business, with a responsible owner.
- Record whether the source applies to that asset and what evidence supports the match.
- Separate evidence of exposure, evidence of activity and evidence of business impact. Leave unanswered questions explicitly open.
What would change the assessment?
Validate site integrity, account permissions, checkout or publishing behavior and recovery of genuine customer activity. Confirm that the affected plugin and unauthorized persistence are no longer present.
Revisit the decision when the provider changes scope, a new account-specific notice arrives or local evidence contradicts the current assumption. Preserve the earlier conclusion and the reason it changed. Do not silently turn a precaution into a confirmed breach, or an absence of telemetry into proof of safety.
Decision checkpoint
Reopen normal publishing or trading only after both technical integrity and business-record reconciliation have been accepted by their owners.