Rank Math PRO Plugin Distributes Malware in Supply Chain Attack

Attackers injected self-restoring backdoors into Rank Math PRO version 3.0.123 packages distributed during a specific window last week.

Threat Times Intrusion DeskOctober 19, 20262 min read

Share LinkedIn Reddit

Illustration: A damaged software package box lies open on a desk, revealing tangled red wires and corrupted circuit boards inside. — AI-generated illustration: Threat Times

Key points

Malware was present in Rank Math PRO version 3.0.123 files downloaded between October 15 and October 16, 2026.
The malicious code installs a backdoor that recreates itself upon page visits, making manual removal difficult.
Rank Math released version 3.0.124 as a clean replacement, but it does not remove existing malware from servers.

Attackers injected malware into Rank Math PRO version 3.0.123 packages distributed between October 15 and October 16, 2026. According to SecurityWeek, the compromised files were available on the vendor's official website during this specific window. The supply chain attack allowed the distribution of malicious code to users who downloaded or updated the plugin during that period.

The malware could allow attackers to take over websites if the plugin was activated. Rank Math states that all users who installed and activated version 3.0.123 between 20:02 UTC on October 15 and 07:12 UTC on October 16 should treat their sites as compromised. The vendor immediately removed the affected files and released a clean version, Rank Math PRO v3.0.124.

Malware Persistence and Behavior

The malicious code establishes persistent access and may expose credentials, API keys, and other secrets. According to Rank Math, the malware can recreate a hidden backdoor upon each page visit. This persistence mechanism makes manual cleanup a difficult task for administrators. The malware may also deploy fake WordPress core files and modify .htaccess files to execute .cache files as PHP code.

Attackers may modify other plugins, themes, and scheduled tasks. The malware communicates with the domain rank1cdn[.]com. BleepingComputer discovered a PHP sample connected to the compromise that creates administrator accounts with specific username prefixes. The vendor warns that changes may extend outside the WordPress installation to system-level files.

Affected Versions and Users

The incident affects only the paid Rank Math PRO plugin. The free Rank Math SEO plugin on WordPress.org remains unaffected, according to BleepingComputer. The free version has more than four million active installations. The compromise is limited to copies of version 3.0.123 obtained during the specific window.

Copies of version 3.0.123 downloaded before the attack window are not affected. The version number alone does not indicate if a file is malicious. Rank Math emailed some users about the incident. Users unsure of their status should contact support, according to The Hacker News.

What should you do?

Users who installed and activated the plugin during the window should restore from a clean backup. If backups are unavailable, administrators must delete the plugin folder and remove malicious database entries. Blocking the attacker’s domain and removing suspicious PHP files is required. Administrators should also check for unauthorized administrator accounts and system-level changes like SSH keys.

What to do and how to stay safe: Rank Math

Verify if you activated Rank Math PRO version 3.0.123 between October 15 and October 16, 2026.
Restore your website from a clean backup created before October 15, 2026.
Check for unauthorized administrator accounts and suspicious PHP files on your server.
Monitor system logs for connections to the domain rank1cdn[.]com.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.