The popular search engine optimization plugin for WordPress blogs, Rank Math PRO, has suffered a security breach via a supply chain attack, which led to the distribution of software packages containing malware that allows full control over sites where the plugin was activated.
The developer stated that the affected versions were limited to version 3.0.123, which was downloaded or updated during a specific time window that began on October 15, 2026, at 20:02 UTC, and extended until October 16, 2026, at 07:12 UTC.
Nature of Risks and Security Impacts
The injected malware exposes infected sites to severe risks, as it allows attackers to:
- Gain permanent and persistent access to the target site.
- Exfiltrate credentials, API keys, and other sensitive information.
- Recreate a hidden backdoor with every new visit to the site's pages.
- Modify WordPress core files and .htaccess files, in addition to manipulating scheduled tasks and cache files.
Required Remediation and Recovery Actions
The developer quickly removed the contaminated files and released a clean version numbered 3.0.124. However, they urged all users who installed or activated version 3.0.123 during the infection window to treat their sites as fully compromised.
The company recommended the following steps to clean the sites:
- Restore the site entirely from a clean backup created before the incident occurred.
- If restoration is not possible, the plugin folder must be permanently deleted, malicious database records removed, and the attacker's domain rank1cdn[.]com blocked.
- Search for and delete suspicious PHP files, as well as monitor for any unknown administrative accounts or modifications outside the scope of the WordPress installation, such as SSH files and other system paths.
- Change all passwords after fully verifying the cleanliness of the site and reinstalling the secure version of the plugin.