Rank Math PRO plugin compromised with hidden backdoor

Between 20:02 UTC on October 15 and 07:12 UTC on October 16, downloads of the Rank Math PRO SEO plugin from the vendor’s website were infected with malware. The compromised version, 3.0.123, installed a hidden backdoor that can persist after activation. Sites that ran the plugin during that 11‑hour window should treat the installation as a breach.

How the infection entered the supply chain

According to BleepingComputer, a limited number of users who obtained version 3.0.123 directly from rankmath.com received a tampered package. The vendor discovered the issue, removed the infected files, and released a clean build labeled 3.0.124. The Hacker News confirms that only copies downloaded or updated during the 11‑hour window are known to be affected; copies obtained earlier are outside the scope of the incident. The free Rank Math SEO plugin hosted on WordPress.org was not part of the breach.

What the malicious code does

Both sources describe the payload as a persistent backdoor that contacts the domain rank1cdn.com. BleepingComputer notes that the malware can recreate hidden backdoors whenever a visitor loads the compromised site. It also harvests database credentials, API keys, and cloud provider secrets such as AWS, Cloudflare, Google Cloud, and Azure tokens. Additional indicators include an XOR‑obfuscated key, a specific WordPress database entry (_np5pvf754c), and a cron‑job marker (#ms6v46). The script can create administrator accounts with the prefix wpsupport_ and the email domain @wp-mail.net, modify core files, and execute arbitrary commands on the server.

Determining if your site was impacted

The vendor’s notice, echoed by The Hacker News, sorts sites into three scenarios:

1. Installed and activated the plugin during the window, treat the site as compromised, even if it has since been updated to 3.0.124.
2. Installed but never activated, delete the plugin files, install the clean 3.0.124 version, and run a security scan.
3. Downloaded only, no immediate action is required unless the files were later installed. If you are unsure which case applies, check your plugin logs for activation timestamps between the stated dates, or scan the file hash against the known compromised version.

Remediation steps

If you confirm infection, follow these actions in order:

• Restore from a clean backup, if you have a full site and database snapshot taken before 20:02 UTC on October 15, restore it, then run a security scan.
• If no clean backup exists, perform a manual clean:
  • Delete the entire rank-math-pro plugin folder from the server.
  • Remove the malicious database entries (e.g., _np5pvf754c) using a trusted database client.
  • Search for and delete any wp‑includes/class‑wp‑cache‑util.php files left behind.
  • Review the wp_users table for unauthorized accounts with the wpsupport_ prefix and remove them.
  • Inspect the wp_options table for unknown cron jobs marked #ms6v46 and delete them.
  • Block outbound connections to rank1cdn.com at the firewall or hosting level.
  • Rotate all WordPress salts, database passwords, API keys, and SSH keys.
  • Run a comprehensive malware scanner (e.g., Wordfence, Sucuri) to catch any residual files in other plugins, themes, or the mu‑plugins directory.
• Re‑install the clean plugin, download version 3.0.124 from your Rank Math account and verify the file checksum before activation.

Reducing future risk

Supply‑chain attacks target the trust relationship between developers and site owners. To limit exposure:

• Prefer plugins hosted on the official WordPress.org repository, which benefits from additional review processes.
• Keep a regular schedule of offline backups and test restoration procedures.
• Use a staging environment to scan new plugins or updates before pushing them live.
• Enable multi‑factor authentication for all WordPress admin accounts and limit privileged users to the minimum necessary role.
• Monitor outbound traffic for connections to unfamiliar domains, especially from PHP processes.
• Subscribe to vendor security advisories and reputable news feeds so you can react quickly when a threat emerges.

By following these steps, you can mitigate the impact of the Rank Math backdoor and strengthen your overall WordPress security posture.