Malicious Rank Math PRO 3.0.123 packages compromise WordPress sites
Original title: Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack
Packages fetched from October 15, 20:02 UTC to October 16, 07:12 UTC may be infected; 3.0.124 is clean.
Rank Math says some Rank Math PRO 3.0.123 packages downloaded last week contained malware that can take over a website if the plugin is activated. The exposure window was October 15, 2026, at 20:02 UTC through October 16, 2026, at 07:12 UTC. The vendor removed the files and released clean version 3.0.124. Activated malware may keep a hidden backdoor, expose credentials and secrets, and change files outside WordPress.
Unconfirmed: Rank Math says some, not all, 3.0.123 packages were malicious, so infection is limited to downloads in the stated window.
- Users who activated 3.0.123 in that window should restore a pre-incident backup.
- The malware may recreate a hidden backdoor on each page visit.
- It can make .cache files run as PHP through .htaccess rules.
- Rank Math says to block the domain rank1cdn.com and remove unknown admin accounts.
- After cleanup, change all passwords and install version 3.0.124.
Impact: Website takeover and exposure of credentials and secrets
| Product | Affected | Fixed in |
|---|---|---|
| Rank Math PRO | 3.0.123 | 3.0.124 |
- 1.Restore sites that activated 3.0.123 during the window from a backup made before the incident.
- 2.Without a backup, delete the plugin, the malicious database entry, suspicious PHP, and unknown admins.
- 3.Block rank1cdn.com, rotate all passwords, and install Rank Math PRO 3.0.124.
- Vendors
- Rank Math
- Products
- Rank Math PRO
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | rank1cdn.com | ove a malicious database entry, block the attacker’s domain rank1cdn[.]com, and find and remove suspicious PHP files and unknown adm |
From the original article
2 min read at securityweek.com
Hackers injected malware into Rank Math PRO version 3. 0. 123 packages distributed between October 15 and October 16.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.