Rank Math PRO Vulnerability: Malicious Updates Re-plant Backdoors on Every Page Visit

Rank Math PRO version 3.0.123 contained malware in packages distributed between October 15 and October 16. Users who activated the plugin during this window should treat their sites as compromised.

What happened

Rank Math stated that version 3.0.123 packages distributed between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware. The vendor removed the affected files and released version 3.0.124 as a clean replacement. According to SecurityWeek, the malware could allow attackers to take over websites if the plugin was activated. The free Rank Math SEO plugin on WordPress.org was not affected.

The malware establishes persistent access by recreating a hidden backdoor upon each page visit. This persistence mechanism makes manual cleanup difficult, as deleting files may not resolve the issue. According to Rank Math, the malware may also deploy fake WordPress core files and modify .htaccess rules to execute .cache files as PHP code.

Why it matters

Installing and activating the compromised version exposes database credentials, API keys, and other secrets to attackers. The malware communicates with the domain rank1cdn[.]com and may create unknown administrator accounts. According to BleepingComputer, a PHP sample named cache-preloader-fff033 (1).php was linked to the compromise, containing code for creating accounts with specific email addresses.

What to watch

• Monitor for connections to rank1cdn[.]com in network logs.
• Check for new administrator accounts with wpsupport_ prefixes.
• Look for modified .htaccess files or unexpected .cache files.
• Review scheduled tasks and cron jobs for unauthorized entries.

Signals worth monitoring

Teams usually detect supply-chain compromises by reviewing installation logs for unexpected version changes during specific time windows. Security operations should correlate web server access logs with database modification timestamps to identify backdoor recreation events. Check whether authentication logs show new administrator accounts created with generic prefixes. Monitor outbound network traffic for connections to unknown domains that may indicate command-and-control communication. Verify that file integrity monitoring alerts trigger on modified core files or .htaccess rules that alter execution permissions for non-standard file types.

Background: File integrity monitoring

File integrity monitoring works by recording cryptographic hashes of critical system files. It continuously compares current hashes against those recorded baselines. Any mismatch triggers an alert, indicating a file has been altered, deleted, or replaced without authorization.

Read the full guide: File Integrity Monitoring: How Hashing Detects Silent Changes

What to do and how to stay safe: Rank Math

• Restore sites from clean backups created before the incident window.
• Delete the Rank Math PRO plugin folder if backups are unavailable.
• Block the domain rank1cdn[.]com at the firewall level.
• Change all passwords and rotate API keys after verification.

Step-by-step guide: Social Engineering: How Manipulation Bypasses Technical Defenses

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is the free version of Rank Math affected?

No, the free Rank Math SEO plugin on WordPress.org was not named in the security notice.

How long was the malware distributed?

The compromised packages were distributed for approximately 11 hours, from October 15 to October 16.

Can I just update to fix the issue?

Updating to version 3.0.124 replaces the plugin but does not remove files or accounts the malware may have placed elsewhere.