WordPress security round-up: 12 to 18 October 2026

If your website runs on WordPress, check three plugins this week: Rank Math SEO PRO, Click to Chat (the WhatsApp button) and 10Web Booster. Each had a serious problem in mid-October. The fix for all three is a plugin update, but Rank Math PRO needs more than that if you installed one bad version.

Rank Math SEO PRO: a bad update carried malware

Rank Math says one release of its paid plugin, version 3.0.123, was shipped with malicious code. It only affects copies downloaded or updated between 15 October 2026, 20:02 UTC and 16 October 2026, 07:12 UTC (in Malaysia time, 16 October from 4:02 am to 3:12 pm). The clean version is 3.0.124. The free Rank Math plugin from WordPress.org is not affected.

Rank Math's advice: if your site ran 3.0.123, treat the site as hacked. An update alone does not remove what the malware may have left behind.

Click to Chat: update to 4.45

Many Malaysian websites use this plugin for the green WhatsApp button. Versions up to 4.44 had a hole that lets anyone run plugin shortcodes on your site without logging in. Version 4.45 is on WordPress.org.

10Web Booster: update to 2.34.11

This speed plugin had a hole in versions up to 2.34.10 that allowed file uploads without a login. Version 2.34.11 fixes it.

The bigger picture

Wordfence counted 497 new WordPress plugin and theme holes in this one week, 23 of them critical. 69 had no fix yet when the report came out. A site is only at risk from the plugins it has installed, so removing the ones you do not use lowers the risk.

What to do

1. Log in to WordPress and open Plugins > Installed Plugins.
2. Look for Rank Math SEO PRO, Click to Chat and 10Web Booster, and note the version numbers.
3. Back up your site first, then update each one.
4. If Rank Math SEO PRO shows 3.0.123, or you updated it on 16 October, follow Rank Math's clean-up steps in the notice linked below, or contact our support team for help.
5. Delete plugins you no longer use.

If a web designer looks after your site, send them this page. Our website maintenance plans also cover plugin updates.

Source and credit

We are sharing this news from Rank Math, WordPress.org and Wordfence. This summary is written by Synctech in our own words.

• Rank Math PRO 3.0.123 Security Incident: How to Secure Your Website, Rank Math, 16 October 2026: https://rankmath.com/kb/pro-3-0-123-security-incident/
• Click to Chat plugin page and changelog, WordPress.org: https://wordpress.org/plugins/click-to-chat-for-whatsapp/
• 10Web Booster plugin page and changelog, WordPress.org: https://wordpress.org/plugins/tenweb-speed-optimizer/
• Wordfence Intelligence Weekly WordPress Vulnerability Report (October 12, 2026 to October 18, 2026), Wordfence: https://www.wordfence.com/blog/2026/10/wordfence-intelligence-weekly-wordpress-vulnerability-report-october-12-2026-to-october-18-2026/

Retrieved 26 October 2026. WordPress, Rank Math, Click to Chat, 10Web and Wordfence are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.