Plugin security incident
A plugin you use was compromised. What now?
Sometimes a trusted plugin update itself carries malware. This guide uses the Rank Math PRO 3.0.123 incident of October 2026 as an example and shows the order of checks we followed on this website before updating.
First step
Read the vendor’s notice before you change anything.
Rank Math published an advisory in its knowledge base. Copies of PRO 3.0.123 downloaded or updated between 15 October 2026 at 20:02 UTC and 16 October at 07:12 UTC were affected, and version 3.0.124 is clean.
- Write down the affected version and the exact time window.
- Write down every indicator the vendor lists: files, database entries, users, scheduled tasks and domains.
- Record the time stamps of the plugin folder before you update or delete it, because an update overwrites them.
- If the site already shows signs of compromise, follow the vendor’s cleanup order instead of the steps below.
When it was installed
The time stamp answers most of the question.
On a server, the modification time of the plugin’s files shows when they were written. On our site all 506 files of the plugin carried the same time, 10 October 2026 at 20:06 UTC. That is five days before the affected window, and no file had changed since.
This is strong evidence, not proof. An attacker who already has access can change time stamps, which is why the next checks still matter.
Indicators
Check every sign the vendor lists.
01
Database
Look for the option names in the advisory. On our site none of them existed.
02
Users
List all administrators and compare them with the people who should have access. Look for user names or email domains the advisory mentions.
03
Files
Look for the fake core file the advisory names, PHP files in the uploads folder and hidden files that contain PHP code.
04
Scheduled tasks
Read the server crontab and the list of WordPress cron events, and explain every entry.
05
Code
Search the site’s PHP files for the domain and the strings listed as indicators.
Want help applying this to your website? See Website security or tell us about your project ↗
Integrity
Compare against known good copies.
wp core verify-checksumscompares the WordPress core files with official checksums.wp plugin verify-checksums --alldoes the same for plugins from WordPress.org. Premium plugins usually have no public checksums.- List every file changed since the start of the window and explain each one, for example your own releases and other updates.
- After updating, compare the old and the new plugin folder. On our site only rebuilt JavaScript files, version numbers and an autoloader name differed.
Update
Back up, update, compare.
- Copy the plugin folder and export the database before the update.
- Save what the site shows to search engines before the update: titles, descriptions, canonical and hreflang links, structured data and the sitemap.
- Update to the clean version, then save the same output again and compare. On our site nothing changed.
- Keep the backup until the comparison is complete, and write down what you checked.
Our checks found no sign of compromise, so a restore from backup and new passwords were not needed. A site that installed the affected copy should follow the vendor’s full recovery steps.
Checklist
When a plugin you use is reported as compromised.
- Do you have the vendor’s advisory, the affected versions and the time window?
- Have you recorded the plugin folder’s time stamps before changing it?
- Were all the listed database entries, users, files and scheduled tasks checked?
- Do the WordPress core files match the official checksums?
- Can you explain every file changed since the start of the window?
- Is there a backup of the plugin folder and the database from before the update?
- Did you compare the site’s search output before and after the update?
- If the site was affected, have all passwords, keys and salts been changed?
Restores belong to the same plan. See WordPress backup restore test.
Need someone to check a site?
Our WordPress care includes backups before changes, update checks and comparisons after them.