Some Rank Math PRO 3.0.123 installation files downloaded from the official website were trojanized for roughly 11 hours. Administrators who activated the affected build should treat their sites as compromised because updating the plugin does not remove established backdoors and credentials may have been exposed.
Affected Time Window
Rank Math said the incident only involved PRO 3.0.123 downloaded from 20:02 UTC on October 15 to 07:12 UTC on October 16, 2026. The company removed the tampered files and released clean version 3.0.124. The free WordPress.org edition was unaffected.
What Does the Malware Do?
Theo cảnh báo của nhà cung cấp, mã độc duy trì quyền truy cập, liên lạc với tên miền rank1cdn[.]com và có thể tái tạo cửa hậu khi có người truy cập website. Dấu vết cần chú ý gồm tệp giả wp-includes/class-wp-cache-util.php, tài khoản quản trị bắt đầu bằng wpsupport_, địa chỉ email miền wp-mail[.]net và tác vụ cron mang dấu #ms6v46.
The Risk Extends Beyond WordPress
Web servers often hold database passwords, API keys, SMTP credentials, cloud-service keys, and sometimes SSH keys. Attackers could therefore expand beyond an SEO plugin. BleepingComputer also analyzed a PHP sample with related indicators, but did not confirm that it was distributed directly through the tampered plugin package.
Who Must Act Immediately?
Sites that installed and activated 3.0.123 during the stated window must be treated as compromised. If the package was only downloaded or installed but never activated, administrators should delete it, install 3.0.124 from their Rank Math account, and run a security scan. Free-edition users need no action for this incident.
Restore from a Clean Backup
The preferred response is to restore files and the database from a backup created before 20:02 UTC on October 15, then rescan and install the clean build. The backup must predate the compromise; restoring a copy that already contains the backdoor will reintroduce the malware.
Disabling the Plugin Is Not Enough
Rank Math nhấn mạnh việc vô hiệu hóa hoặc cập nhật plugin không đủ. Khi không có bản sao lưu sạch, cần xóa toàn bộ thư mục rank-math-pro, loại bỏ các mục cơ sở dữ liệu độc hại được hãng công bố, chặn kết nối ra rank1cdn[.]com, rồi rà soát plugin, theme, thư mục uploads, tệp .htaccess, tài khoản quản trị và lịch tác vụ.
Rotate Every Potentially Exposed Secret
After containment and cleanup, administrators should change WordPress, hosting, FTP/SFTP, and SSH credentials; replace database credentials; regenerate security keys and salts; and revoke and reissue API, SMTP, payment, and cloud-service keys. Login, process, and outbound-connection logs should be preserved for investigation.
Supply-Chain Lessons
A package downloaded from an official website can still become a delivery channel if release infrastructure is compromised. Organizations should retain file hashes, limit web-process privileges, separate secrets from code, monitor changes, and regularly test recovery. These controls reduce damage even when a trusted vendor is breached.
Conclusion
The Rank Math PRO incident shows that upgrading only removes the distribution source; it does not erase access already established. Sites that activated 3.0.123 during the affected window need full restoration or cleanup, credential rotation, and continued monitoring.
VNCyberS compiled from Rank Math and BleepingComputer
Tiếng Việt
English