The Rank Math compromise turned some official downloads of the paid WordPress SEO plugin into a delivery mechanism for malware. According to the vendor, affected copies of Rank Math PRO version 3.0.123 could compromise websites when administrators activated them.
The malicious downloads were available between October 15 at 20:02 UTC and October 16 at 07:12 UTC. Rank Math subsequently removed the affected files and released clean version 3.0.124.
However, installing the replacement does not remove an infection that has already taken hold. Administrators who activated an affected copy should treat their websites as compromised.
Incident Affected PRO Downloads During an 11-Hour Window
Rank Math said the incident affected a limited number of users who downloaded PRO version 3.0.123 during the specified period. It has not disclosed the number of potentially compromised websites.
The free Rank Math SEO plugin available through WordPress.org remained unaffected. Although that version has more than four million active installations, those figures do not represent the scope of this attack.
The distinction matters because the malicious files came through the vendor’s official PRO download channel. Users could therefore encounter the threat while obtaining software from its expected source.
The initial method attackers used to compromise that delivery channel remains undisclosed.
Malware Recreates Backdoors After Infection
According to Rank Math, the malware establishes persistent access and communicates with the attacker-controlled domain rank1cdn[.]com.
It can also recreate hidden backdoors when someone visits an infected website. Consequently, removing a single malicious file may leave other components capable of restoring access.
The vendor warned that affected installations could expose database credentials, API keys and other secrets available to the web server.
For this reason, deactivating the plugin or upgrading to the clean release is insufficient after compromise. Recovery must address the wider website environment and any exposed credentials.
Related PHP Sample Suggests Broader Capabilities
A separate investigation identified a PHP malware sample that shares several indicators with the Rank Math compromise. However, investigators could not confirm whether the compromised plugin distributed that particular file.
The overlapping indicators included the database entry _np5pvf754c, the scheduled-task marker #ms6v46 and an obfuscation key listed in the vendor’s alert.
The sample also contained code for creating administrator accounts with usernames beginning wpsupport_ and email addresses ending wp-mail.net.
Additionally, it appeared capable of creating the wp-includes/class-wp-cache-util.php backdoor identified in Rank Math’s advisory.
Other functions included command execution, database modification and theft of cloud credentials, SSH keys and sensitive information. These capabilities describe the related sample; they do not establish that every affected website experienced those actions.
Clean Backups Offer a Recovery Route
Rank Math recommends restoring both website files and the database from a known-clean backup where one is available.
Administrators should also run security scans and rotate passwords, API keys and WordPress security salts. Replacing exposed credentials helps address access that could remain possible even after removing malicious files.
However, a backup must predate the infection to provide a reliable recovery point. Restoring compromised files or database contents could reintroduce the threat.
The vendor also recommends blocking outbound connections to rank1cdn[.]com.
Manual Cleanup Must Extend Beyond the Plugin
For websites without a safe backup, Rank Math advises manual cleanup. This begins with deleting the entire affected plugin folder and removing malicious database entries.
Administrators must then investigate additional backdoors, unauthorized administrator accounts, modified files and scheduled tasks. They should also check for changes outside WordPress.
Because the malware can restore hidden components, a plugin-only cleanup may leave the website exposed.
Users who installed the affected version but never activated it should delete that copy and download clean version 3.0.124. Rank Math also recommends scanning those websites.
The vendor has released a clean plugin package, but affected site owners still need to investigate and remove any existing compromise.
0 responses to “Rank Math Compromise Delivers Website Backdoors Through Official PRO Downloads”