cyber.hendryadrian.com
Cyber Attack & Data Breach · securityweek.com

Malicious Rank Math PRO Release Could Compromise WordPress Sites

· Original article ↗

Summary

Rank Math says its compromised PRO plugin version 3.0.123 may have enabled website takeovers and exposed secrets. The company removed the affected files and released version 3.0.124; affected users are urged to restore clean backups or follow cleanup steps.

Key points

  • Rank Math says some version 3.0.123 packages were compromised; downloads and updates during October 15–16, 2026, may have been affected.
  • The malware could enable persistent website access and expose credentials, API keys, and other secrets.
  • Rank Math advises users who installed and activated the affected version during the incident window to treat their websites as compromised and restore a clean pre-incident backup.
  • The malware may recreate a hidden backdoor, deploy fake WordPress files, alter .htaccess rules, add PHP-bearing .cache files, create scheduled tasks, and modify plugins or themes.
  • Users unable to restore a backup are advised to remove the plugin folder and malicious database entry, block rank1cdn[.]com, and investigate suspicious files, accounts, processes, and system-level persistence.
  • Rank Math removed the affected files and released clean version 3.0.124; after verifying cleanup, administrators should change passwords and install the clean version.

Article Details

Victim Organization
Unknown
Incident Type
Supply-chain compromise of Rank Math PRO packages containing malware
Incident Date
2026-10-15
Data Types Exposed
  • Credentials
  • API keys
  • Other secrets
Operational Impact
Websites with the affected plugin version may have been infected and could be taken over. The malware may establish persistent access, recreate a hidden backdoor on page visits, alter website files and settings, and make manual cleanup difficult.
Claim Status
confirmed

Indicators of compromise

TypeIndicatorContext
DOMAINrank1cdn[.]comDomain Rank Math identified users should block in connection with the malicious plugin compromise.

Vendors

Rank MathUsers downloaded malicious versions of Rank Math PRO last week, after the WordPress SEO plugin was compromised in a supply chain attack.

Products

Rank Math PROUsers downloaded malicious versions of Rank Math PRO last week, after the WordPress SEO plugin was compromised in a supply chain attack.

Related Articles