Rank Math, maker of a widely used WordPress SEO plugin, has confirmed that some downloads of its premium Rank Math PRO plugin were trojanized in a supply-chain attack last week, exposing websites to hidden backdoors upon activation.
According to the vendor, users who downloaded version 3.0.123 between October 15 at 20:02 UTC and October 16 at 07:12 UTC received compromised files. “The affected plugin files contained malware that could compromise your website if the plugin was activated,” Rank Math said in its advisory, noting the malicious files were removed and a clean version, 3.0.124, was released.
Only the paid PRO version was affected. The free Rank Math SEO plugin, active on more than 4 million sites via WordPress.org, remained untouched.
What the malware does
Per the vendor, the malware establishes persistent access, communicates with a command-and-control domain at rank1cdn[.]com, and recreates hidden backdoors whenever the infected site is visited. Sites running the compromised build risk exposure of database credentials, API keys, and other server-accessible secrets.
BleepingComputer separately identified a PHP sample on VirusTotal, named ‘cache-preloader-fff033 (1).php’, sharing indicators of compromise listed in Rank Math’s advisory, including an XOR obfuscation key, a specific WordPress database entry, a cron job marker, and rogue admin accounts created with a ‘wpsupport_’ username prefix and ‘@wp-mail.net’ email addresses. The script appears to function as a first-stage dropper for the ‘wp-includes/class-wp-cache-util.php’ backdoor referenced in the advisory, and includes capabilities for remote command execution, database manipulation, and theft of AWS, Cloudflare, Google Cloud, Azure, and SSH credentials. BleepingComputer could not confirm whether this sample was distributed through the compromised plugin itself, though the shared IoCs point to the same threat actor.
Remediation
Rank Math is urging anyone who installed and activated the plugin during the 11-hour window to treat their site as compromised. Recommended steps include restoring from a clean backup, rotating all passwords, keys, and salts, and running security scans. Where no clean backup exists, manual cleanup is required: deleting the entire plugin folder and malicious database entries, since simply deactivating or updating the plugin will not remove the threat. Admins should also hunt for additional backdoors, unauthorized admin accounts, altered files, and rogue scheduled tasks, and block outbound traffic to rank1cdn[.]com. Users who downloaded but never activated the plugin should delete it, install the clean 3.0.124 release, and scan their site before reactivating.
Rank Math has not disclosed how many sites were affected or detailed the initial attack vector.
