Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack

What it is

Some Rank Math PRO 3.0.123 packages, the WordPress SEO plugin, contained malware after a supply chain compromise. Rank Math says the affected download window ran from 15 October 2026 20:02 UTC to 16 October 2026 07:12 UTC. Rank Math removed the files and released a clean v3.0.124.

How it works

The page gives the malware's capabilities, not its delivery chain. Rank Math says it may:

• recreate a hidden backdoor on each page visit, which makes manual cleanup hard;
• deploy fake WordPress core files;
• modify .htaccess files to add rules that run .cache files as PHP;
• drop .cache files containing PHP code;
• schedule tasks and cron jobs;
• modify other plugins and themes, and upload further files.

The attackers could also change things outside the WordPress installation. Credentials, API keys and other secrets may be exposed.

Preconditions / Affected

The site is affected if the plugin was downloaded or updated to 3.0.123 in the window above and then activated. A download alone may have been infected, but the page says the takeover happens when the plugin is activated. Only some 3.0.123 packages carried the malware.

What to do

Treat every site that installed and activated 3.0.123 in the window as compromised. Restore from a clean backup made before the incident.

If no backup exists, Rank Math's steps are:

1. Delete the Rank Math PRO plugin folder.
2. Remove a malicious database entry (the page does not say which one).
3. Block the attacker's domain, rank1cdn[.]com.
4. Find and remove suspicious PHP files and unknown administrator accounts.

Also check beyond the WordPress directory:

• SSH authorized_keys files
• crontabs belonging to other system users
• suspicious processes
• any other location the web server user can write to

Once the site is verified clean, change all passwords and install clean Rank Math PRO v3.0.124.

Caveats

The page does not identify the malicious database entry, give file names or hashes, or explain how the packages were compromised. Rank Math words its claims as "may" throughout, so the full extent of the compromise is unconfirmed. Because the malware can reach outside WordPress, deleting the plugin folder alone does not clean a site.