Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack

Hackers injected malware into Rank Math PRO WordPress plugin version 3.0.123 packages distributed between October 15, 2026, 20:02 UTC and October 16, 2026, 07:12 UTC. The malware enables persistent backdoors that can recreate themselves upon page visits, exposing credentials, API keys, and other secrets. It modifies .htaccess files, drops PHP code disguised as .cache files, schedules tasks and cron jobs, alters other plugins and themes, and may affect system-level files outside the WordPress installation. Rank Math promptly removed the malicious files and released version 3.0.124. Users who installed or activated the compromised version should restore from backups or follow extensive manual cleanup procedures including deleting plugin folders, removing malicious database entries, blocking attacker domains, and checking for suspicious system files and processes.

The malware provides attackers with persistent access to compromised websites, potentially exposing sensitive credentials, API keys, and secrets. It can maintain persistence by recreating backdoors on each page visit and modifying core WordPress files, plugins, themes, and system-level files. This could lead to full site takeover and unauthorized control over affected web servers.

A clean version 3.0.124 of Rank Math PRO has been released and should be installed immediately. Users who installed or activated version 3.0.123 between October 15, 2026, 20:02 UTC and October 16, 2026, 07:12 UTC should treat their sites as compromised. They should restore from clean backups created before the incident. If backups are unavailable, users must delete the Rank Math PRO plugin folder, remove malicious database entries, block the attacker’s domain rank1cdn[.]com, and remove suspicious PHP files and unknown administrator accounts. Additionally, users should check for and remove fake WordPress core files, .htaccess modifications, scheduled tasks, altered plugins/themes, and any suspicious files or processes outside the WordPress installation. After cleanup, all passwords should be changed and a clean plugin version installed.