Malware shipped in Rank Math PRO 3.0.123; clean build is 3.0.124
Original title: Rank Math PRO WordPress Plugin Compromised to Spread Malware and Steal Credentials
Only premium downloads activated between October 15 and 16, 2023, are in scope; the free plugin is unaffected.
Rank Math said malware was distributed in Rank Math PRO 3.0.123 and that sites are at risk if administrators activated it. The contaminated downloads were available from October 15, 2023, at 20:02 UTC until October 16, 2023, at 07:12 UTC. The malware can recreate a hidden backdoor on page visits, so disabling the plugin is not enough. Rank Math removed the files, shipped 3.0.124, and advises treating accessible secrets as exposed.
Unconfirmed: Rank Math has not identified the attacker, how the distribution files were compromised, or how many installations were affected.
- Delete options _uf6qdn2hmm, t8krdk990phb, and _np5pvf754c from the WordPress options table.
- Block outbound connections to rank1cdn.com where hosting or firewall controls allow it.
- Look for wpsupport_ admin accounts and addresses ending in @wp-mail.net.
- Downloading 3.0.123 without activating it does not by itself mean the site was compromised.
Impact: hidden backdoor and possible exposure of site credentials
| Product | Affected | Fixed in |
|---|---|---|
| Rank Math PRO | 3.0.123 | 3.0.124 |
- 1.Restore files and the database from a backup made before October 15, 2023, 20:02 UTC, then install 3.0.124.
- 2.Delete the rank-math-pro directory and options _uf6qdn2hmm, t8krdk990phb, and _np5pvf754c.
- 3.Rotate site, hosting, and API credentials and block outbound traffic to rank1cdn.com.
- Vendors
- Rank Math
- Products
- Rank Math PRO
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | rank1cdn.com | Rank Math also recommends blocking outbound connections to rank1cdn[.]com where hosting or firewall controls allow it. The advisory |
| domain | wp-mail.net | unts that start with wpsupport_, email addresses ending in @wp-mail[.]net, and the fake WordPress core file wp-includes/class-wp-ca |
From the original article
2 min read at gbhackers.com
Rank Math has reported a security incident involving malware distributed through Rank Math PRO version 3. 0. 123.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.