"The affected plugin files contained malware that could compromise your website if the plugin was activated," Rank Math warned.
Rank Math PRO v3.0.123 and the 11-hour window
Rank Math, the vendor of a WordPress search engine optimization (SEO) plugin, says a limited number of downloads of Rank Math PRO version 3.0.123 distributed from its official site between October 15 at 20:02 UTC and October 16 at 07:12 UTC contained malware. The vendor removed the affected files and published a clean build, Rank Math PRO v3.0.124. Rank Math also noted that the free Rank Math SEO plugin on WordPress.org remained unaffected; the compromise involved only the paid PRO edition, the vendor said.
Malware behavior, persistence, and indicators
According to Rank Math's advisory and reporting by BleepingComputer, the trojanized files establish persistent access and communicate with the domain rank1cdn[.]com. The malicious code can recreate hidden backdoors when a visitor loads an infected website, and it can expose database credentials, API keys, and other secrets accessible to the web server.
BleepingComputer located a PHP malware sample on VirusTotal named 'cache-preloader-fff033 (1).php' that contains the same indicators of compromise (IoCs) included in Rank Math's alert. Those IoCs include an XOR obfuscation key marked "xmmqhn", a WordPress database entry "_np5pvf754c", a cron job marker "#ms6v46", and code that creates administrator accounts using the "wpsupport_" username prefix with "@wp-mail.net" email addresses. The sample appears to act as a first-stage deployment script that creates the backdoor file referenced by Rank Math at wp-includes/class-wp-cache-util.php.
Functionality observed in the PHP sample includes command execution on infected hosts, modification of WordPress databases, and the capability to harvest credentials and secrets such as AWS, Cloudflare, Google Cloud, and Azure credentials, along with SSH keys and other sensitive information.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleCleanup guidance from Rank Math and practical steps
Rank Math's advisory urges any user who installed and activated the compromised 3.0.123 build during the specified 11-hour window to assume their site is compromised and to follow the vendor's clean-up procedures. Key steps the vendor recommends include restoring files and the database from a clean backup, running security scans, and rotating all passwords, keys, and salts.
For sites without a verified clean backup, Rank Math warns that simply deactivating or updating the plugin after a compromise will not remove the threat. The vendor recommends a manual cleanup that begins with deleting the entire plugin folder and any malicious database entries, then investigating for additional backdoors, unauthorized administrator accounts, altered files, scheduled tasks (cron jobs), and potential changes outside WordPress. Rank Math also advises blocking all outbound connections to the attacker's rank1cdn[.]com domain. Users who downloaded but did not activate the compromised plugin should delete it, install the clean 3.0.124 version, and scan their sites.
Scope, exposure, and what BleepingComputer confirmed
Rank Math PRO is the paid version of the plugin family, and the free variant is active on more than 4 million websites, the vendor noted. Rank Math did not publish a count of affected sites in its advisory. BleepingComputer reported the linkage between the VirusTotal sample and the vendor’s IoCs but said it could not confirm whether that specific PHP sample had been distributed through the compromised plugin files. BleepingComputer also reported contacting Rank Math for additional details about the number of potentially affected sites and the initial attack vector but received no response by the time of publication.
What this means for website administrators, security teams, and purchasers
- Website administrators: If you activated Rank Math PRO v3.0.123 between October 15 20:02 UTC and October 16 07:12 UTC, treat your site as compromised. Restore from a verified clean backup where possible; otherwise, follow the manual removal steps Rank Math details and rotate all credentials and keys.
- Security teams and incident responders: Investigate for the IoCs Rank Math and BleepingComputer published—particularly the _np5pvf754c database entry, the #ms6v46 cron marker, and the wpsupport_ admin accounts—and check for the wp-includes/class-wp-cache-util.php backdoor and outbound connections to rank1cdn[.]com.
- Procurement and site owners evaluating plugins: Note that the free Rank Math plugin on WordPress.org was not affected, but the incident underscores supply-chain risk in vendor-distributed paid components; ensure update and distribution channels are validated before broad deployment.
In short, a narrow distribution window and a trojanized release created a classic supply-chain risk: a trusted component delivered from an official vendor site carried code that could persist, exfiltrate secrets, and rebuild access. Rank Math's issuance of a clean 3.0.124 build and the published IoCs provide immediate mitigation steps, but affected administrators must assume compromise and pursue the full cleanup steps the vendor outlined.
Source: BleepingComputer — "WordPress SEO plugin Rank Math compromised to backdoor websites"
