By Hamza Faisal
Copies of the Rank Math PRO WordPress plugin downloaded from the vendor's official website last week carried malware that could plant hidden backdoors on websites, Rank Math confirmed in a security advisory. The supply-chain attack affected version 3.0.123 of the paid SEO plugin and hit only files served directly from rankmath.com during a narrow 11-hour window.
According to the vendor, users who downloaded or updated to Rank Math PRO 3.0.123 between 20:02 UTC on October 15 and 07:12 UTC on October 16 received tampered files. Activating the plugin could compromise the entire website. Rank Math says it immediately removed the affected files and released a clean replacement, version 3.0.124.
The free Rank Math SEO plugin — active on more than 4 million websites via the official WordPress.org repository — was not affected. The compromise was strictly limited to the paid PRO version distributed through the vendor's own infrastructure.
A backdoor that refuses to die
Security researchers say the implanted malware is built for persistence. Once active, it establishes a backdoor and communicates with a command-and-control domain, rank1cdn[.]com. The script is designed to recreate its malicious entries even if site owners delete certain files, and it can restore the hidden backdoor whenever the infected website is visited.
BleepingComputer's analysis found the malware can also create rogue administrator accounts and expose sensitive material accessible to the web server — including WordPress database credentials, API keys, SSH keys, and cloud infrastructure credentials for services such as AWS, Google Cloud, Azure, and Cloudflare. One researcher found a related PHP malware sample on VirusTotal that appears to act as the first-stage deployment script behind the attack.
What affected site owners should do
Rank Math is telling anyone who installed and activated version 3.0.123 during the exposure window to treat their websites as compromised. The cleanup guidance recommends restoring site files and the database from a backup made before the window opened, running a security scan, and rotating every secret the server could see: passwords, database credentials, WordPress salts, API and payment keys, and hosting and SSH credentials.
If no clean backup exists, the vendor advises manually deleting the plugin's entire folder, removing the malicious database entries, blocking outbound connections to the attacker domain, then checking for leftover backdoors, unauthorized administrator accounts, altered files, and malicious scheduled tasks. Wordfence warns that simply deactivating or updating the plugin will not remove the threat — the malware may already have planted files and accounts elsewhere on the server.
The supply-chain lesson
The incident is another reminder that the plugins millions of sites trust can become the attack vector themselves. With Rank Math powering SEO for a large share of the web's WordPress installations, a tampered build served from the official source — even for just 11 hours — puts real businesses at risk. Security teams are advising site owners to verify plugin downloads, keep verified offline backups, and monitor for unexpected administrator accounts and outbound connections after any plugin update.
