Malware Discovered in Rank Math PRO WordPress Plugin
Recent downloads of the Rank Math PRO WordPress plugin from the official vendor’s site have been compromised, introducing malware that creates clandestine backdoors as part of a supply-chain attack last week.
The vendor disclosed that a small segment of users who installed version 3.0.123 of the plugin between October 15 at 20:02 UTC and October 16 at 07:12 UTC encountered tainted versions that could jeopardize their websites upon activation.
“The files associated with the affected plugin encompassed malware that could endanger your website if activated,” Rank Math cautioned.
“We promptly eliminated the compromised files and launched a secure version, Rank Math PRO v3.0.124.”
Those who installed and activated the malicious version during this 11-hour timeframe should regard their websites as compromised and adhere to the remediation protocols detailed in the vendor’s advisory.
Rank Math PRO serves as a WordPress search engine optimization (SEO) tool, enhancing website visibility in search outcomes. This premium variant upgrades the complimentary edition, which is currently active on over 4 million websites.
Exposed Sensitive Information
According to an advisory from the vendor, the breach exclusively affected the PRO version; the free variant of Rank Math SEO from WordPress.org remained secure.
Rank Math elucidated that the malware facilitates enduring access, communicates with ‘rank1cdn[.]com,’ and regenerates hidden backdoors when the infected site is accessed.
The vendor warns that individuals who installed the compromised Rank Math PRO version risk exposing database credentials, API keys, and other sensitive information that can be accessed by web servers.
In an investigation of the attack, BleepingComputer identified a PHP malware sample on VirusTotal titled ‘cache-preloader-fff033 (1).php,’ purportedly linked to the Rank Math breach.
Although this particular file was not mentioned in the advisories from Rank Math or Wordfence, BleepingComputer discovered it incorporated similar indicators of compromise (IoCs) as those listed in Rank Math’s warning:
- XOR obfuscation key ‘xmmqhn’
- WordPress database entry ‘_np5pvf754c’
- Cron job marker ‘#ms6v46’
- Code to generate administrative accounts with the ‘wpsupport_’ username prefix and ‘@wp-mail.net’ email addresses
The malware appears to function as a preliminary deployment script that crafts the ‘wp-includes/class-wp-cache-util.php’ backdoor referenced in Rank Math’s advisory.
This PHP script also possesses capabilities to execute commands, alter WordPress databases, and expropriate AWS, Cloudflare, Google Cloud, and Azure credentials, along with SSH keys and other confidential information.
While these IoCs suggest a connection to the same threat actor implicated in the Rank Math attack, BleepingComputer could not ascertain whether the file was disseminated via the compromised plugin.
Recommendations for Cleanup
Website administrators suspecting a breach should restore their website files and databases from a pristine backup, conduct thorough security scans, and rotate all passwords, keys, and salts.
If there are no reliable backups available, Rank Math recommends a meticulous manual cleanup, emphasizing that simply deactivating or updating the plugin post-compromise will not eradicate the threat.
Cleanup entails deleting the entire plugin directory and any malicious database entries, followed by an investigation for additional backdoors, unauthorized administrative accounts, altered files, scheduled tasks, and any changes beyond WordPress.
It is also advisable to block all outbound connections to the attacker’s rank1cdn[.]com domain.
Users who installed but did not activate the plugin should delete it immediately, obtain the secure 3.0.124 version, and then scan their sites comprehensively.
BleepingComputer reached out to Rank Math for insights regarding the number of potentially affected sites and the initial attack vector but did not receive a response by the time of publication.
Overall prevention metrics can obscure what transpires following initial access. Once adversaries leverage valid credentials, prevention efficacy diminishes markedly.
The Blue Report 2026 evaluates defense mechanisms on a technique-by-technique basis across 338 million simulations executed in customer production environments.
Source link: Bleepingcomputer.com.
