Compromised Rank Math PRO Downloads Could Backdoor WordPress Websites
Summary
Some Rank Math PRO v3.0.123 downloads from October 15–16 contained malware. The vendor removed the files and released v3.0.124; users who activated the compromised version should treat their sites as compromised and follow cleanup guidance.
Key points
- Only Rank Math PRO v3.0.123 downloads between October 15 at 20:02 UTC and October 16 at 07:12 UTC were reported affected; the free plugin was unaffected.
- The vendor removed the compromised files and released clean version 3.0.124. The article does not establish how many sites were affected or the initial attack vector.
- According to Rank Math, the malware establishes persistent access, communicates with rank1cdn[.]com, and can recreate hidden backdoors when an infected site is visited.
- The vendor warns that activating the compromised plugin could expose database credentials, API keys, and other secrets available to the web server.
- BleepingComputer found a PHP malware sample with indicators matching the vendor’s alert, but could not confirm it was distributed through the compromised plugin.
- Recommended cleanup includes restoring from a clean backup or manually removing malicious files and database entries, checking for additional backdoors and unauthorized changes, scanning sites, and rotating passwords, keys, and salts.
- Users who installed but never activated the plugin should delete it, install the clean version, and scan their sites; the article says deactivation or updating alone will not remove an existing compromise.
Article Details
- Victim Organization
- Rank Math
- Incident Type
- Supply-chain compromise of Rank Math PRO plugin downloads, distributing malware that planted persistent backdoors on websites where the plugin was activated.
- Incident Date
- 2026-10-15
- Data Types Exposed
- Database credentials
- API keys
- AWS credentials
- Cloudflare credentials
- Google Cloud credentials
- Azure credentials
- SSH keys
- Other secrets accessible to the web server
- Operational Impact
- A limited number of downloads of Rank Math PRO version 3.0.123 during the stated window contained malware. Activating the compromised plugin could compromise the website by establishing persistent access and planting hidden backdoors. Rank Math removed the affected files and released a clean version, 3.0.124. The number of affected sites was not disclosed.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | rank1cdn[.]com | Identified as the attacker's domain used by the malware for communication; the article recommends blocking outbound connections to it. |