Last week, the popular WordPress SEO plugin, Rank Math PRO, fell victim to a supply chain attack, leading to the distribution of malicious software. The compromised versions of the plugin were inadvertently downloaded by users, posing a significant risk to their websites.
Details of the Plugin Compromise
Rank Math has confirmed that certain packages of version 3.0.123 contained malware capable of enabling attackers to gain control over affected websites. This vulnerability was present in downloads and updates made between 20:02 UTC on October 15, 2026, and 07:12 UTC on October 16, 2026.
To address the breach, Rank Math promptly removed the compromised files and issued a secure update, Rank Math PRO v3.0.124. Users who had installed the infected version are advised to consider their websites compromised and should restore them using a backup from before the attack.
Risks and Remediation Steps
The malware embedded in the compromised plugin version could facilitate persistent access for attackers, potentially exposing sensitive information such as credentials and API keys. Rank Math warns that the malware might recreate a hidden backdoor on each page visit, complicating manual removal efforts.
In cases where a backup restoration is not feasible, users are instructed to delete the Rank Math PRO plugin directory, eliminate a malicious database entry, block the attacker’s domain rank1cdn[.]com, and search for suspicious PHP files and unauthorized administrator accounts.
Broader Security Implications
Beyond direct plugin modifications, the malware could install fake WordPress core files, alter .htaccess files, execute .cache files as PHP code, and tamper with other plugins and themes. It might also schedule unauthorized tasks, upload malicious files, and even make changes outside the WordPress environment.
Web administrators are urged to inspect for unauthorized SSH keys, crontabs of other system users, and unusual server processes. Upon confirming the website’s security, it is crucial to change all passwords and install a clean version of the Rank Math PRO plugin.
Related vulnerabilities and patches in other systems, such as Plex servers and various network security products, highlight ongoing cybersecurity challenges and the importance of maintaining vigilant security practices.
