Rank Math PRO WordPress Plugin Hit by Supply-Chain Attack

Rank Math has confirmed that its PRO WordPress plugin was targeted in a supply-chain attack last week, resulting in the distribution of malicious code to a limited number of users. The compromise allowed attackers to plant hidden backdoors on websites where the affected version was installed and activated.

The vendor identified that version 3.0.123 of the Rank Math PRO plugin was tampered with on its official website. The window of exposure occurred between 15 October at 20:02 UTC and 16 October at 07:12 UTC. Users who downloaded or updated the plugin during this 11-hour period are at risk.

According to Rank Math, the free version of the SEO plugin, which is used on more than 4 million websites via the official WordPress repository, was not affected by this incident. The compromise was strictly limited to the paid PRO version distributed through the vendor’s own infrastructure.

Persistent Backdoors and Credential Theft

The malware contained within the compromised plugin functions as a first-stage deployment script. Once active, it establishes a persistent backdoor and communicates with a command-and-control domain, rank1cdn[.]com. The script is designed to recreate malicious entries even if certain files are deleted, ensuring the attackers maintain access to the host environment.

Security analysis indicates that the malware is capable of extracting highly sensitive information, including:

• WordPress database credentials and API keys;
• SSH keys stored on the web server;
• Cloud infrastructure credentials for AWS, Google Cloud, Azure, and Cloudflare;
• Authorised administrator accounts created with the wpsupport_ prefix.

The malware also attempts to create a specific file located at wp-includes/class-wp-cache-util.php to facilitate long-term remote access and command execution.

Manual Cleanup Required for Infected Sites

Rank Math has released version 3.0.124, which is a clean version of the plugin. However, the vendor warns that simply updating or deactivating the plugin is insufficient for websites that have already been compromised. Because the malware creates persistent database entries and additional files outside of the plugin folder, a manual cleanup is necessary.

Administrators of affected sites should restore their files and databases from a known clean backup created before 15 October. If a backup is unavailable, Rank Math recommends a thorough security audit to remove unauthorised administrator accounts, delete the _np5pvf754c database entry, and clear any scheduled tasks (cron jobs) marked with #ms6v46.

Organisations are also advised to rotate all passwords, secret keys, and salts associated with the website and any connected cloud services. Outbound connections to the rank1cdn[.]com domain should be blocked at the firewall level to prevent further communication with the attacker’s infrastructure.