Rank Math PRO plugin compromised in supply‑chain attack

Rank Math, a popular paid WordPress SEO plugin, released a compromised version of its PRO edition on October 15‑16, 2026. Between 20:02 UTC on Oct 15 and 07:12 UTC on Oct 16, the site’s official download page served a malicious build of version 3.0.123 that could install a backdoor when activated. Rank Math immediately pulled the infected files and published a clean 3.0.124 update, warning users to treat sites that had been installed as compromised.

How the malware works

The malware embedded in the infected package creates persistent access points on the host and contacts an external domain, rank1cdn.com. It recreates hidden backdoors whenever a page is loaded, and it can add new administrator accounts, modify core files, insert PHP code into .cache files, and alter .htaccess rules. SecurityWeek notes the threat can also schedule cron jobs, change other plugins, and leave footprints outside the WordPress installation such as in SSH authorized_keys files.

Only the paid PRO version was affected; the free Rank Math plugin distributed through WordPress.org remains untouched. The vendor has not yet disclosed how many sites were infected. BleepingComputer uncovered a separate PHP sample that shares indicators of compromise with the plugin, showing that the same threat actor likely distributed the malware, but it could not confirm whether it was delivered through the compromised plugin package.

Cleaning the compromised sites

Rank Math recommends that site administrators who used the affected build either restore their site from a backup taken before the incident or, if no backup exists, delete the entire plugin folder, remove malicious database entries, block the attacker’s domain, and scan for unknown admin accounts or suspicious PHP files. After confirming a clean environment, users should rotate all passwords, keys and salts and install the latest clean version of the plugin.

This incident illustrates the risk of supply‑chain attacks on WordPress plugins and the difficulty of removing a well‑hidden backdoor. Attackers can leave persistent access that may be re‑activated on each page visit, making manual cleanup a challenge. The security community stresses the importance of monitoring plugin downloads, keeping backups, and verifying that third‑party code is unmodified before installation.