Rank Math PRO 3.0.123 compromised: backdoor on WordPress sites

Rank Math PRO, the paid edition of one of the most widely used SEO plugins for WordPress, has been compromised in a supply chain attack. According to the vendor’s advisory, as reported by SecurityWeek and BleepingComputer, some version 3.0.123 packages downloaded from the official website between 15 October 2026 at 20:02 UTC and 16 October at 07:12 UTC contained malware capable of taking over the site once the plugin was activated.

Rank Math removed the tampered files and released the clean version 3.0.124. The free edition, Rank Math SEO distributed through WordPress.org and active on more than 4 million sites according to BleepingComputer, is not affected. The vendor speaks of a limited number of users; how many sites were hit and how the attackers tampered with the packages has not been disclosed: BleepingComputer asked Rank Math for both details and received no reply.

How the malware works

According to Rank Math’s advisory, the malicious code in the plugin establishes persistent access, communicates with the rank1cdn[.]com domain and recreates a hidden backdoor on every visit to the site. That is why deactivating or updating the plugin after the compromise is not enough: manual cleanup is difficult.

SecurityWeek lists what the malware can do:

• deploy fake WordPress core files;
• modify .htaccess files so that files with the .cache extension run as PHP, and drop .cache files containing PHP code;
• create WordPress scheduled tasks and system cron jobs;
• modify other plugins and themes and upload further files;
• make changes outside the WordPress installation, wherever the web server user has write access: SSH authorized_keys files, crontabs of other users, running processes.

The vendor warns that a compromised site exposes database credentials, API keys and other secrets readable by the web server.

Public indicators

The indicators from Rank Math’s advisory, as reported by BleepingComputer, are:

• the rank1cdn[.]com domain;
• the _np5pvf754c WordPress database entry;
• the #ms6v46 marker in cron jobs;
• the XOR obfuscation key xmmqhn;
• administrator accounts whose username starts with wpsupport_ and whose email address ends in @wp-mail.net;
• the wp-includes/class-wp-cache-util.php backdoor.

BleepingComputer also found on VirusTotal a PHP script, cache-preloader-fff033 (1).php, carrying the same indicators. It appears to be a first stage that creates the backdoor in wp-includes and can execute commands, modify the WordPress database and steal AWS, Cloudflare, Google Cloud and Azure credentials, SSH keys and other sensitive data. The outlet notes that it could not confirm this file was distributed through the compromised plugin, although the indicators link it to the same actor.

In our reading, the relevant MITRE ATT&CK techniques are T1195.002 (Compromise Software Supply Chain), T1505.003 (Web Shell), T1136 (Create Account), T1053.003 (Cron), T1098.004 (SSH Authorized Keys), T1036.005 (Match Legitimate Name or Location) and T1552.001 (Credentials In Files).

Impact for European and Italian organisations

The sources do not mention victims or affected countries, but distribution went through the official website and concerned anyone who downloaded or updated the plugin during those 11 hours, including web agencies that manage many client sites. The risk does not stop at the website: with database credentials, API keys and cloud keys the attackers can move on to other systems, and on servers shared by several sites, write access outside WordPress widens the perimeter.

For NIS2 entities this is a supply chain security case: a purchased plugin is still third-party software that belongs in the inventory. If the site processes personal data (forms, customer accounts, orders), a confirmed compromise must also be assessed for the notification required by the GDPR.

What to do now

1. Check the Rank Math PRO version on every WordPress site you manage and the date of the last update: anyone who installed 3.0.123 in the 15–16 October window is at risk.
2. If the plugin was activated, treat the site as compromised. The path Rank Math recommends is restoring files and database from a clean backup taken before the incident, followed by a security scan.
3. Without a safe backup, follow the vendor’s manual cleanup: delete the entire plugin folder and the malicious database entry, block outbound connections to rank1cdn[.]com, find and remove suspicious PHP files, executable .cache files, anomalous .htaccess rules, fake core files and unknown administrator accounts, and check scheduled tasks and modified plugins and themes.
4. Look outside WordPress too: authorized_keys, crontabs of system users, suspicious processes and every folder writable by the web server user.
5. After cleanup, rotate every credential: WordPress and database passwords, API keys, the keys and salts in wp-config.php, and any cloud and SSH keys reachable from the server. Then install the clean 3.0.124 version.
6. If the plugin was installed but never activated, delete it, download 3.0.124 and scan the site anyway.

How ARXDOME helps

On the Linux servers hosting the sites, the ARX Sentry agent checks file integrity in the chosen folders: it can flag new PHP files and changes to .htaccess or to the wp-includes folder. The inventory of processes and ports helps spot unfamiliar processes, and with ARX Shield a compromised machine can be isolated from the network until it is cleaned up.

Last updated: 19 October 2026