Rank Math PRO WordPress Plugin Compromised in Malware Distribution Incident
Rank Math disclosed a security breach involving malware distributed through Rank Math PRO version 3.0.123, affecting WordPress websites that activated the compromised plugin. The malicious files were distributed to a limited number of users between October 15, 2026, at 20:02 UTC and October 16 at 07:12 UTC. The free version of Rank Math, available via WordPress.org, remained unaffected.
The malware employs a persistence mechanism, making recovery more complex than a standard plugin update or deactivation. Even after removal, visiting an infected site could trigger a hidden backdoor, requiring administrators to eliminate specific components before cleanup. Rank Math released a clean version (3.0.124) and advised users to treat affected sites as fully compromised.
Key Indicators of Compromise (IoCs) and Cleanup Steps:
- Malicious files: Delete the entire rank-math-pro directory and remove entries from the WordPress options table (e.g., _uf6qdn2hmm, t8krdk990phb, _np5pvf754c).
- Network activity: Block outbound connections to rank1cdn.com.
- Suspicious code: Inspect PHP files for base64_decode with XOR loops (key: xmmqhn), proc_open, and PHP-FPM socket code.
- Fake accounts: Check for admin usernames starting with wpsupport_ and emails ending in @wp-mail[.]net.
- Additional red flags: Malicious .htaccess rules, scheduled tasks (#ms6v46), and unexpected PHP files in uploads directories.
Recovery Recommendations:
- Restore from a clean backup created before October 15, 2026, at 20:02 UTC.
- If no backup exists, conduct a full manual inspection, including SSH keys, system crontabs, and writable server directories.
- Rotate all credentials, including WordPress passwords, database access, security keys, API tokens, and hosting credentials.
- Verify WordPress core integrity, scan for malware, and monitor for reinfection.
Users who never activated the compromised plugin should delete it and perform a security scan. Only after thorough cleanup should affected users install the patched version 3.0.124. The advisory did not identify the attacker or confirm credential theft in all cases.
Source: https://cyberpress.org/rank-math-pro-wordpress-plugin-hacked/
Rank Math SEO cybersecurity rating report: https://www.rankiteo.com/company/rankmath
"id": "RAN1792492018",
"linkid": "rankmath",
"type": "Breach",
"date": "10/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Limited number of users who '
'activated Rank Math PRO version '
'3.0.123',
'industry': 'WordPress Plugin Development',
'name': 'Rank Math',
'type': 'Software Vendor'},
{'customers_affected': 'Users of affected WordPress '
'sites',
'industry': 'Various',
'name': 'WordPress Website Owners',
'type': 'End Users'}],
'attack_vector': 'Compromised Software Supply Chain',
'customer_advisories': 'Users who activated the compromised plugin should '
'follow recovery recommendations; others should delete '
'the plugin and perform a security scan',
'data_breach': {'file_types_exposed': ['PHP files',
'Malicious .htaccess rules'],
'personally_identifiable_information': 'Potential (if '
'accessed during '
'compromise)',
'sensitivity_of_data': 'High (if admin credentials or PII '
'were accessed)',
'type_of_data_compromised': 'Potential admin credentials, '
'WordPress site data, and '
'sensitive information'},
'date_detected': '2026-10-15T20:02:00Z',
'description': 'Rank Math disclosed a security breach involving malware '
'distributed through Rank Math PRO version 3.0.123, affecting '
'WordPress websites that activated the compromised plugin. The '
'malicious files were distributed to a limited number of users '
'between October 15, 2026, at 20:02 UTC and October 16 at '
'07:12 UTC. The free version of Rank Math, available via '
'WordPress.org, remained unaffected. The malware employs a '
'persistence mechanism, making recovery more complex than a '
'standard plugin update or deactivation. Even after removal, '
'visiting an infected site could trigger a hidden backdoor, '
'requiring administrators to eliminate specific components '
'before cleanup. Rank Math released a clean version (3.0.124) '
'and advised users to treat affected sites as fully '
'compromised.',
'impact': {'brand_reputation_impact': "Negative impact on Rank Math's "
'reputation due to malware distribution',
'data_compromised': 'Potential unauthorized access to WordPress '
'sites, admin credentials, and sensitive data',
'identity_theft_risk': 'Potential risk if personally identifiable '
'information was accessed',
'operational_impact': 'Compromised site integrity, potential '
'backdoor access, and persistence mechanisms',
'systems_affected': 'WordPress websites using Rank Math PRO '
'version 3.0.123'},
'initial_access_broker': {'backdoors_established': 'Hidden backdoor triggered '
'by visiting infected '
'sites',
'entry_point': 'Compromised plugin distribution '
'(Rank Math PRO 3.0.123)'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Importance of verifying plugin integrity, maintaining '
'clean backups, and thorough cleanup procedures for '
'compromised sites',
'post_incident_analysis': {'corrective_actions': 'Release of patched version, '
'cleanup guidance, and '
'enhanced security measures '
'for plugin distribution',
'root_causes': 'Compromised software supply chain '
'(plugin distribution)'},
'recommendations': ['Restore from a clean backup created before October 15, '
'2026, at 20:02 UTC',
'Conduct a full manual inspection if no backup exists',
'Rotate all credentials (WordPress, database, API tokens, '
'hosting)',
'Verify WordPress core integrity and scan for malware',
'Monitor for reinfection and suspicious activity',
'Delete the compromised plugin and install the patched '
'version (3.0.124) only after cleanup'],
'references': [{'source': 'Rank Math Advisory'}],
'response': {'communication_strategy': 'Public advisory to users with cleanup '
'steps and recommendations',
'containment_measures': 'Release of patched version (3.0.124), '
'removal of malicious files, and '
'blocking outbound connections to '
'rank1cdn.com',
'enhanced_monitoring': 'Monitoring for reinfection and '
'suspicious activity',
'recovery_measures': 'Rotate all credentials, verify WordPress '
'core integrity, scan for malware, and '
'monitor for reinfection',
'remediation_measures': 'Delete rank-math-pro directory, remove '
'malicious entries from WordPress '
'options table, inspect PHP files for '
'suspicious code, check for fake admin '
'accounts, and restore from clean '
'backups'},
'stakeholder_advisories': 'Rank Math advised users to treat affected sites as '
'fully compromised and follow cleanup steps',
'title': 'Rank Math PRO WordPress Plugin Compromised in Malware Distribution '
'Incident',
'type': 'Malware Distribution',
'vulnerability_exploited': 'Compromised plugin version (Rank Math PRO '
'3.0.123)'}