Rank Math PRO WordPress plugin compromised to backdoor websites

Some downloads of the Rank Math PRO WordPress plugin from the vendor’s official website contained malware that could install hidden backdoors, BleepingComputer reports. The vendor said a limited number of users who downloaded version 3.0.123 between October 15 at 20:02 UTC and October 16 at 07:12 UTC received compromised files. The window lasted about 11 hours.

Rank Math said it removed the affected files and released a clean version, Rank Math PRO v3.0.124. The malware could compromise a website if the plugin was activated. The vendor said it establishes persistent access, communicates with “rank1cdn[.]com,” and can recreate hidden backdoors when someone visits an infected site. The vendor also warned that the compromised plugin could expose database credentials, API keys, and other secrets available to the web server.

The free Rank Math SEO plugin was not affected, according to the vendor. It is active on more than 4 million websites.

BleepingComputer found a PHP malware sample on VirusTotal that appeared connected to the incident, but said it could not confirm whether the sample was distributed through the compromised plugin. The vendor advised users who installed and activated version 3.0.123 during the affected period to treat their sites as compromised and follow its cleanup procedures. It said deactivating or updating the plugin alone would not remove the threat.