A version of Rank Math PRO, the paid edition of a popular WordPress search-engine-optimization plugin, carried malware when downloaded from the vendor's own website for about 11 hours last week, BleepingComputer reported Monday. The incident shows how a trusted software update can become the way attackers get into a company's website, and why any organization running WordPress needs a plan for a compromised vendor.
What Happened
Rank Math said in an advisory, "Rank Math PRO 3.0.123 Security Incident: How to Secure Your Website," that version 3.0.123 contained malware if downloaded between Oct. 15 at 20:02 UTC and Oct. 16 at 07:12 UTC, or 4:02 p.m. to 3:12 a.m. Eastern time. The vendor said "a limited number of users" downloaded it but gave no count. It has released a clean version, 3.0.124.
The free version of Rank Math on WordPress.org was not affected, according to the advisory. BleepingComputer reported that the free edition is active on more than 4 million websites. Rank Math did not respond to BleepingComputer's questions about how many sites were hit or how the attackers got in, and the vendor has not said who was responsible.
The advisory says the malware can recreate a hidden backdoor whenever someone visits an infected site. Its warning signs include a fake WordPress core file, administrator accounts with names starting "wpsupport_" or email addresses ending in "@wp-mail.net," scheduled tasks, rules in the site's .htaccess configuration file that make disguised ".cache" files run as code, and outbound connections to the domain rank1cdn.com. According to BleepingComputer, Rank Math warned that the malware can expose database credentials, API keys and other secrets the web server can read.
BleepingComputer also found a related script on VirusTotal, a malware-scanning service, that shares the vendor's indicators. That script can steal Amazon Web Services, Cloudflare, Google Cloud and Microsoft Azure credentials as well as SSH keys, which unlock remote server access. BleepingComputer said it could not confirm the script was distributed through the plugin.
What Site Owners Should Do
Rank Math's advisory sorts users into three groups:
- Installed and activated 3.0.123 in the window: treat the site as compromised. The vendor recommends restoring files and database from a backup made before Oct. 15 at 20:02 UTC, scanning, then rotating every credential, including passwords, database credentials, WordPress salts, API keys, hosting and SSH or FTP access, and two-factor authentication.
- Installed but never activated: delete the files, install 3.0.124 and run a security scan.
- Downloaded only: the vendor sees no sign of compromise from this incident alone.
Without a clean backup, manual cleanup starts with deleting the entire rank-math-pro folder, because "Deactivating the plugin alone is not sufficient," the advisory says, then removing the malicious database entries and blocking rank1cdn.com. Rank Math also says it "will never send login or download links by email," a warning worth passing on as attackers may exploit the incident with phishing.
Why It Matters
Corporate marketing, campaign and regional websites frequently run on WordPress, and they are often managed by agencies or marketing teams rather than the security department. Paid plugins like Rank Math PRO update from the vendor's own servers, so the usual advice to keep software current became the route of infection here.
The bigger risk is what sits next to the website. If cloud keys, database passwords or shared hosting accounts live on the same server, an attacker inside a marketing site can reach systems far more valuable than the site itself. That makes credential rotation, not plugin removal, the step boards and security chiefs should confirm.
What to Watch
- Whether Rank Math explains how its distribution was breached and how many sites installed the bad version.
- Signs that stolen cloud or hosting credentials are used in follow-on attacks.
- Similar compromises at other commercial WordPress plugin vendors that distribute updates outside WordPress.org.
