Trojanized Rank Math PRO 3.0.123 planted website backdoors
Original title: WordPress SEO plugin Rank Math compromised to backdoor websites
Only downloads from a roughly 11-hour window were affected; the vendor shipped clean version 3.0.124.
Rank Math said some downloads of Rank Math PRO 3.0.123 from its official site between October 15 at 20:02 UTC and October 16 at 07:12 UTC contained malware that could compromise a site if activated. The vendor removed the files and released Rank Math PRO 3.0.124. The free WordPress.org edition was not affected. The malware seeks persistent access, contacts rank1cdn[.]com, and can recreate hidden backdoors; activating it can expose database credentials, API keys and other secrets.
Unconfirmed: Rank Math had not told BleepingComputer how many sites were affected or the initial attack vector.
- Deactivating or updating after compromise does not remove the backdoors.
- Administrators should restore clean backups and rotate passwords, keys and salts.
- Block outbound connections to rank1cdn[.]com.
- A VirusTotal PHP sample shared the vendor’s indicators but was not confirmed as distributed.
Impact: Persistent backdoors and theft of credentials and secrets
| Product | Affected | Fixed in |
|---|---|---|
| Rank Math PRO | 3.0.123 downloaded October 15 20:02 UTC to October 16 07:12 UTC | 3.0.124 |
- 1.Treat activated 3.0.123 installs as compromised and restore files and the database from a clean backup.
- 2.Delete the plugin folder and malicious database entries, then install clean Rank Math PRO 3.0.124.
- 3.Rotate passwords, keys and salts, and block outbound connections to rank1cdn[.]com.
- Vendors
- Rank Math
- Products
- Rank Math PROWordPress
- Organizations
- Wordfence
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | rank1cdn.com | e malware establishes persistent access, communicates with ‘rank1cdn[.]com,’ and recreates hidden backdoors when someone visits the |
From the original article
3 min read at bleepingcomputer.com
Some downloads of the Rank Math PRO WordPress plugin from the vendor's official website carried malware that planted hidden backdoors in a supply-chain attack last week. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.