Malicious Rank Math PRO Plugin Copies Delivered Backdoor to WordPress Sites
Summary
Rank Math said PRO plugin copies downloaded or updated during a specified October 15–16 window contained malware. Sites that activated them should be treated as compromised; the company released a clean version and recovery requires more than reinstalling the plugin.
Key points
- Rank Math said affected PRO plugin copies were downloaded or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16. The free WordPress.org plugin was not named.
- The malware can recreate a hidden backdoor when someone visits an affected site. Rank Math and Wordfence have not published code analysis or identified who was behind it.
- Installing clean version 3.0.124 replaces the plugin but does not remove possible backdoors, administrator accounts, or scheduled tasks elsewhere on the server.
- Rank Math recommends restoring a site and database backup from before the exposure window when available, then scanning, changing credentials, and installing the clean version.
- Without a clean backup, owners should follow the prescribed manual cleanup order, check for other unauthorized changes, change all site-accessible credentials, and run security scans and checksum checks.
- The company has not disclosed how the malicious files entered its download and update system, how many customers received them, or package hashes. It also has not linked this incident to other premium-plugin update-channel compromises.
Article Details
- Victim Organization
- Unknown
- Incident Type
- Compromise of Rank Math PRO distribution and update systems, delivering malware that installed a self-restoring backdoor on affected WordPress sites.
- Incident Date
- 2026-10-15
- Disclosure Date
- 2026-10-16
- Data Types Exposed
- Passwords, database credentials, API keys, and other secrets accessible to affected sites; potential exposure was reported, but theft was not confirmed.
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- Sites that installed and activated an affected copy should be treated as compromised. The malware could recreate its hidden backdoor when a site was visited and may have left files, administrator accounts, scheduled tasks, or SSH keys. The number of affected customers and any service disruption were not disclosed.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | rank1cdn[.]com | Rank Math tells site owners to block this domain in connection with the incident; its malicious role is not further described. |
MITRE ATT&CK
T1053 · Scheduled Task/JobThe article says the malware may have added scheduled tasks.T1136.001 · Local AccountThe article says the malware may have created administrator accounts on affected sites.T1195.002 · Compromise Software Supply ChainMalicious copies were delivered through the vendor's plugin download and update systems, consistent with a software supply-chain compromise.
CVE
Vendors
Products
Rank Math PROCopies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 containedWordPressCopies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained