Rank Math PRO WordPress Plugin 3.0.123 Compromised in Supply-Chain Attack

Some downloads of the Rank Math PRO WordPress plugin from the vendor’s official website contained malware that installed a hidden backdoor during a recent supply-chain attack.

Rank Math said a limited number of users who downloaded version 3.0.123 between October 15 at 20:02 UTC and October 16 at 07:12 UTC received a compromised build. Websites could be compromised when the plugin was activated.

“The affected plugin files contained malware that could compromise websites if the plugin was activated,” Rank Math said in its security incident advisory.

The vendor removed the affected files and released a clean version, Rank Math PRO 3.0.124.

Users who installed and activated the trojanized version during the affected 11-hour period should treat their websites as compromised and follow Rank Math’s removal instructions.

Only Rank Math PRO was affected

Rank Math PRO is the paid version of the Rank Math SEO plugin for WordPress, which helps improve a website’s search visibility. The free version of Rank Math SEO, available through WordPress.org, was not affected. The plugin is active on more than 4 million websites.

According to Rank Math, the malware establishes persistent access and communicates with rank1cdn[.]com. When someone visits an infected website, the hidden backdoor can be recreated.

The vendor warned that an infected installation could expose database credentials, API keys, and other secrets that provide access to web servers and connected services.

Malware indicators and backdoor capabilities

During its investigation, BleepingComputer identified a PHP malware sample named cache preloader-fff033 (1).php on VirusTotal. The sample appears to be related to the Rank Math compromise.

The file is used by the plugin for caching and ranking-related functions. After examining the advisory, BleepingComputer found that it contained the same indicators of compromise identified by Rank Math and Wordfence, including:

• xmmqhn XOR obfuscation key
• _np5pvf754c WordPress database entry
• #ms6v46 cron job marker
• Code that creates an administrator account using the wpsupport_ username prefix and the @wp-mail.net email address

The malware appears to function as a first-stage deployment script that creates the wp-includes/class-wp-cache-util.php backdoor described in Rank Math’s advisory.

The PHP scripts can also execute commands, modify WordPress databases, and steal AWS, Cloudflare, Google Cloud, Azure, and SSH credentials, along with other sensitive information.

Although these indicators suggest the files were linked to the same attacker as the Rank Math incident, BleepingComputer could not confirm whether the sample was distributed through a compromised plugin.

How to clean an infected WordPress website

Website administrators who may have installed and activated Rank Math PRO 3.0.123 should:

• Restore the website’s files and database from clean backups, if available.
• Run comprehensive security scans.
• Rotate all passwords, API keys, authentication keys, and WordPress salts.
• Remove the entire plugins folder and malicious database entries.
• Check for additional backdoors, unauthorized administrator accounts, modified files, and scheduled tasks.
• Investigate possible changes outside the WordPress installation.
• Block outbound connections to rank1cdn[.]com.

Rank Math warns that simply deactivating or updating the plugin after a breach will not remove the threat. Administrators without secure backups should follow the vendor’s manual cleanup instructions.

Users who downloaded the plugin but did not activate it should remove the affected version, install the clean Rank Math PRO 3.0.124 release, and scan their websites.

BleepingComputer contacted Rank Math for more information about the number of potentially affected websites and the initial attack vector, but had not received a response by the time of publication.

The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.

The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report