WordPress SEO plugin Rank Math PRO backdoored in supply-chain attack

Trojanized downloads from official site may have compromised sites; clean version released

By LineZotpaper

Published19 October 2026

Read Time2 min

A supply-chain attack replaced downloads of the Rank Math PRO WordPress plugin from the vendor's official website with trojanized files last week, prompting warnings that affected site owners should treat their websites as compromised.

WordPress site owners who downloaded Rank Math PRO during an 11-hour window last week may have received a trojanized version of the SEO plugin, according to the vendor and security researchers.

Rank Math said that version 3.0.123 of the paid plugin, downloaded from its official website between October 15 at 20:02 UTC and October 16 at 07:12 UTC, was replaced with compromised files in a supply-chain attack. "The affected plugin files contained malware that could compromise your website if the plugin was activated," the vendor warned. It said it removed the affected files and released a clean version, 3.0.124. Only the PRO edition was affected; the free Rank Math SEO plugin distributed through WordPress.org was not.

The malware establishes persistent access, communicates with the domain rank1cdn[.]com, and recreates hidden backdoors when an infected site is visited, according to Rank Math's advisory. The vendor warned that activating the compromised plugin could expose database credentials, API keys and other secrets held by the web server.

Separately, BleepingComputer said it found a PHP malware sample on VirusTotal containing the same indicators of compromise listed in Rank Math's alert, including a 'wpsupport_' administrator account prefix, '@wp-mail.net' email addresses, and an '#ms6v46' cron job marker. The sample appears to be a first-stage script that deploys the 'wp-includes/class-wp-cache-util.php' backdoor, and can execute commands, modify WordPress databases and steal cloud and SSH credentials. BleepingComputer said it could not confirm the sample was distributed through the plugin.

Rank Math advises affected users to treat their websites as compromised, restore from a clean backup and rotate all passwords, keys and salts. Those without a backup should delete the plugin folder and malicious database entries, investigate for unauthorized admin accounts and scheduled tasks, and block outbound connections to rank1cdn[.]com. Users who installed but did not activate the plugin should delete it, install the clean version and scan their sites.

Analysis

Why This Matters

Supply-chain attacks compromise trust in official downloads, putting sites at risk even when owners follow normal update practices.
Rank Math's free version is active on more than four million sites, making any related campaign a broad security concern for the WordPress ecosystem.
Compromised sites can expose database credentials, API keys and other secrets, with potential for persistent backdoors.

Background

WordPress plugins have long been a common entry point for website attacks, and supply-chain compromises, where attackers slip malicious code into legitimate software updates or downloads, have become a recurring threat. In this incident, the malicious code was delivered from the vendor's own website during a limited window last week, before Rank Math replaced the affected files with a clean release.

Key Perspectives

Rank Math: The vendor says it removed the malicious files, released a clean version and published cleanup procedures, warning that deactivating or updating the plugin will not remove the threat once a site is compromised. Website administrators: Site owners are urged to treat affected sites as fully compromised, restore from clean backups where possible, and manually scrub plugin folders and databases for backdoors, extra admin accounts and altered files. Security researchers: BleepingComputer's examination of a related malware sample found code capable of stealing cloud and SSH credentials and creating administrator accounts, though the publication could not confirm the sample was part of the plugin distribution.

What to Watch

Whether Rank Math discloses how many sites downloaded the compromised version and how the attack entered its supply chain.
Further analysis of the malware family behind the backdoor, including its command-and-control activity via rank1cdn[.]com.
Additional attempts by the same threat actor against other WordPress plugins, given the reuse of indicators observed by researchers.

Sources

WordPress SEO plugin Rank Math compromised to backdoor websites · BleepingComputer

Checked

8 claims in this story checked against 1 source: 5 supported.

Show each claim

Partly supportedHeadline: Rank Math PRO was backdoored in a supply-chain attack.BleepingComputer: “Some downloads of the Rank Math PRO WordPress plugin from the vendor’s official website carried malware that planted hidden backdoors in a supply-chain attack last week.”
Partly supportedVersion 3.0.123 of Rank Math PRO was replaced with compromised files in a supply-chain attack.BleepingComputer: “a limited number of users who downloaded version 3.0.123 of the plugin between October 15 at 20:02 UTC and October 16 at 07:12 UTC received compromised versions”
SupportedRank Math warned: "The affected plugin files contained malware that could compromise your website if the plugin was activated."BleepingComputer: ““The affected plugin files contained malware that could compromise your website if the plugin was activated,” Rank Math warned”
Partly supportedActivating the compromised plugin could expose database credentials, API keys and other secrets held by the web server.BleepingComputer: “The vendor warns that users installing the compromised version of Rank Math PRO expose database credentials, API keys, and other secrets accessible to the web server.”
SupportedRank Math said it removed the affected files and released a clean version, 3.0.124.BleepingComputer: ““We immediately removed the affected files and released a clean version, Rank Math PRO v3.0.124.””
SupportedOnly the PRO edition was affected; the free Rank Math SEO plugin from WordPress.org was not.BleepingComputer: “An advisory from the vendor highlights that only the PRO version was compromised and the free version of Rank Math SEO from WordPress.org remained unaffected.”
SupportedA PHP malware sample on VirusTotal contained the same indicators as Rank Math's alert, including the 'wpsupport_' admin prefix, '@wp-mail.net' emails and the '#ms6v46' cron marker, and BleepingComputer could not confirm it was distributed through the plugin.BleepingComputer: “BleepingComputer found it contained the same indicators of compromise (IoCs) included in Rank Math's alert: xmmqhn' XOR obfuscation key the '_np5pvf754c' WordPress database entry the '#ms6v46' cron job marker code for creating administrator accounts using the 'wpsupport_' username prefix and '@wp-mail.net' email addresses”
SupportedUsers who installed but never activated the plugin should delete it, install clean 3.0.124, and scan their sites.BleepingComputer: “Users who installed but never activated the plugin should now delete it, download the clean 3.0.124 version, and then scan their sites.”