Security Breach in Rank Math PRO Plugin Distribution
Rank Math has issued a significant advisory regarding a security breach affecting its PRO version of the WordPress SEO plugin.
The notice, released on October 16, reveals that versions downloaded from rankmath.com or received as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contain malicious code.
Any installation of these compromised versions should be considered vulnerable. This malware possesses the capability to establish its secretive backdoor, recurrently reactivating whenever a user accesses the affected site.
In response, Rank Math undertook the removal of the compromised files and has introduced a secure update, 3.0.124.
While this update replaces the plugin files, it may not eliminate existing malware-related files, unauthorized administrator accounts, or scheduled tasks previously integrated into the server, as noted by Wordfence in their advisory on October 17.
Identifying Affected Users
It is important to note that the version number alone does not indicate whether a copy is compromised.
Rank Math’s changelog identifies version 3.0.123, dated October 7, as outside the scope of the vulnerability. The breach is specifically restricted to versions downloaded or updated during the outlined time frame.
Those who obtained version 3.0.123 prior to the outlined window are not affected. The security notice categorizes users into three distinct scenarios:
- If you installed and activated 3.0.123 during the vulnerability window, consider your site compromised. Follow recovery procedures, even if subsequently updated to 3.0.124.
- If you downloaded but did not activate the plugin, delete the files, install 3.0.124 from your Rank Math account, and conduct a thorough security scan.
- If you downloaded without installation or activation, there is no indication of compromise from this incident alone.
Rank Math has proactively communicated with some users and encourages anyone uncertain about their installation status to connect with their support team.
This warning pertains exclusively to the PRO plugin, available directly from rankmath.com, not to the free version found on WordPress.org, which has over four million active installations and was last updated on October 6.
Nature of the Malware
Details about the malware are confined to the advisories from Rank Math and Wordfence, neither of which has provided an in-depth code analysis or identified the perpetrators behind the attack.
Merely deleting suspicious files may not suffice to resolve the issue, underscoring the importance of the outlined cleanup protocol.
The malware may have left PHP backdoor files in various plugin directories, themes, the must-use plugins directory, and may have created unauthorized administrator accounts, introduced a counterfeit WordPress core file, modified .htaccess files for PHP execution of .cache files, and implanted scheduled tasks and SSH keys.
It is prudent for site owners to assume that any credentials, passwords, or API keys the site could access may have been compromised.
Wordfence has categorized this incident as CVE-2026-111862, assigning it a severity rating of 9.8 out of 10, with the researcher involved remaining unidentified.
Furthermore, Patchstack has classified it as a backdoor attack and indicated that, due to the nature of the intrusion occurring within Rank Math’s own systems, no mitigation rule can currently be applied.
Recovery Steps
Rank Math advocates for restoration from a backup as the primary recovery method. If a backup exists prior to 20:02 UTC on October 15, restore it, conduct a security scan, change all passwords, and subsequently install version 3.0.124.
In the absence of a clean backup, the cleanup must be systematic, commencing with three essential actions:
- Completely delete the rank-math-pro plugin directory via the hosting file manager or FTP, noting that merely deactivating the plugin will not suffice.
- In the wp_options table, expunge any entries corresponding to option_names _uf6qdn2hmm, t8krdk990phb, or _np5pvf754c.
- Prevent outgoing connections to rank1cdn[.]com if allowable by the hosting provider or firewall.
After these steps, the search for additional changes should extend to the following areas:
- Files: Look for PHP files in wp-content/mu-plugins/, within other plugins, in inc/, includes/, and lib/ directories of non-default themes, and also in Rank Math’s own includes/ folder and uploads/.
- Code: Inspect for PHP code utilizing base64_decode, XOR loops, and other suspicious patterns.
- File: wp-includes/class-wp-cache-util.php, which is not recognized as a core WordPress file.
- Accounts: Check for administrator usernames starting with wpsupport_ or accounts linked to email addresses ending in @wp-mail[.]net.
- Server: Review .htaccess rules, .cache files that include PHP code, crontab entries marked with #ms6v46, scheduled events, SSH authorized_keys files, and other potential external vulnerabilities.
Wordfence emphasizes that the absence of these elements does not guarantee a website’s security.
It is imperative to change all credentials, even if restoring from a backup. This includes not only WordPress passwords but also database usernames and passwords, security keys, API keys, and access credentials for various integrated systems.
Final security measures should include conducting a scan for vulnerabilities and verifying checksums for the WordPress core and all installed plugins, although checksums for premium plugins might not be available, particularly for this instance.
Once all cleanup actions are diligently executed, download the clean version 3.0.124 directly from rankmath.com. Some users may need to reset their passwords to access their accounts, though Rank Math does not provide login or download links via email.
Omissions from Rank Math’s Disclosure
Rank Math, now part of the Scandinavian hosting conglomerate group. has not clarified how the malicious code infiltrated their distribution channels, the number of customers impacted, or whether automatic updates were involved in disseminating the infected packages.
Furthermore, no information has been released regarding the hash values of both clean and compromised plugin versions. The company states that they are enhancing security measures to mitigate future risks.
Records indicate that the domain rank1cdn[.]com, which Rank Math advises users to block, was registered shortly before the attack window opened, suggesting premeditated actions.
Recurring Threats in the Industry
This incident marks at least the third occurrence this year where a premium WordPress plugin’s vendor-led update process has distributed backdoored versions.
Previous breaches include Nextend’s Smart Slider 3 Pro in April and ShapedPlugin’s Pro plugins in June, among others.
Although past attacks have occurred, there remains no concrete evidence linking the perpetrators of these incidents to the current attack on Rank Math.
Source link: Thehackernews.com.
