Rank Math PRO Plugin Compromised in Supply-Chain Attack
A supply-chain attack last week impacted certain downloads of the Rank Math PRO WordPress plugin from the vendor's official website, planting hidden backdoors.
Radwan AbdulhadiEditor and technology writer
Supply-Chain Attack Affects Rank Math PRO
Last week, a supply-chain attack compromised certain downloads of the Rank Math PRO WordPress plugin directly from the vendor's official website, according to reports detailed by [BleepingComputer](https://www.bleepingcomputer.com/news/security/wordpress-seo-plugin-rank-math-compromised-to-backdoor-websites/). The security incident affected users who downloaded version 3.0.123 of the plugin within an 11-hour window spanning from October 15 at 20:02 UTC to October 16 at 07:12 UTC.
The vendor reported that the affected plugin files carried malware capable of compromising websites upon activation. In response to the breach, the team swiftly removed the compromised files and released a clean version, Rank Math PRO v3.0.124. Detailed guidance can be found in the [advisory from the vendor](https://rankmath.com/kb/pro-3-0-123-security-incident/) published regarding the incident.
Scope and Impact on WordPress Sites
Rank Math PRO is a search engine optimization plugin designed to improve website visibility in search results. While the paid variant faced this supply-chain compromise, the free version of Rank Math SEO—which remains [active on more than 4 million websites](http://wordpress.org/plugins/seo-by-rank-math)—was unaffected.
Sites that installed and activated the trojanized version during the restricted timeframe must treat their systems as compromised. The malware is designed to establish persistent access, communicate with 'rank1cdn[.]com', and recreate hidden backdoors whenever visitors browse the infected website. Furthermore, the vulnerability exposes database credentials, API keys, and other secrets accessible to the web server.
Malware Analysis and Indicators
During ongoing research into the incident, security analysts identified a related [PHP malware sample on VirusTotal](https://www.virustotal.com/gui/file/f99a42f622e9a638f1b27dc051a48619a5a2d7f3432a4480fecf1413253629c9) bearing the name 'cache-preloader-fff033 (1).php'. Although this specific file was omitted from the initial vendor and [Wordfence](https://www.wordfence.com/blog/2026/10/rank-math-seo-pro-3-0-123-malware/) advisories, it contained matching indicators of compromise.
The script acts as a first-stage deployment mechanism capable of creating administrator accounts using the 'wpsupport_' username prefix alongside '@wp-mail.net' email addresses. It also features capabilities to execute commands, alter WordPress databases, and exfiltrate sensitive keys, including AWS, Cloudflare, Google Cloud, Azure credentials, and SSH keys.
Remediation and Recovery Procedures
Site administrators who suspect an active compromise are urged to restore both website files and databases from a clean, uninfected backup. Following restoration, teams must run comprehensive security scans and rotate all passwords, keys, and salts.
For webmasters lacking a secure backup, manual cleanup is necessary because simply deactivating or updating the plugin post-infection will not eliminate the threat. This manual process requires deleting the entire plugin folder and purging malicious database entries. Additionally, administrators should inspect for unauthorized administrator accounts, altered files, scheduled tasks, and block any outbound connections directed to the attacker's rank1cdn[.]com domain.
Sources
- BleepingComputerWordPress SEO plugin Rank Math compromised to backdoor websites
Continue chronologically
Related stories
Fresh WordPress Vulnerability Targeted by Attackers
Threat actors are actively targeting a high-severity unauthenticated race condition vulnerability in WordPress leading to remote code execution.
Critical PHP Vulnerabilities Threaten Websites Worldwide
Security patches roll out for two critical PHP vulnerabilities rated 9.2, impacting millions of sites and prompting warnings from cybersecurity agencies.
Critical Bricksforge WordPress Plugin Flaw Under Attack
A critical vulnerability in the Bricksforge WordPress plugin is actively exploited in the wild, allowing unauthenticated threat actors to gain full control.
Hackers Hijack cPGuard Autoupdate to Deploy Backdoors
Attackers compromised the update infrastructure for the cPGuard web security suite, distributing a backdoor and data-stealing script to thousands of servers.
