Some downloads of Rank Math PRO 3.0.123, a popular WordPress SEO plugin, contained malware. Sites that received this version on 15 or 16 October, for example through an automatic update, may now have a backdoor. Rank Math published a security notice and a clean version, 3.0.124, on 16 October.
What happened?
According to Rank Math, copies of PRO 3.0.123 downloaded or updated between 15 October 20:02 UTC and 16 October 07:12 UTC contained malware “that could compromise your website if the plugin was activated”. The company removed the affected files and released 3.0.124.
This is a supply chain attack: the malware arrived through the vendor’s own update, not through a mistake by the site owner. For once, keeping plugins up to date was part of the problem.
Rank Math says only “a limited number of users” were affected and gives no count. As of 16 October it has not said how the attackers got into its distribution channel.
What does the malware do?
Rank Math’s notice describes a persistent backdoor. In its words, “The malware can recreate its hidden backdoor whenever someone visits the website.” Deactivating or updating the plugin alone therefore does not clean the site.
The vendor lists these signs of infection:
- a fake WordPress core file,
wp-includes/class-wp-cache-util.php - new administrator accounts named
wpsupport_…with addresses atwp-mail[.]net .htaccessrules that let.cachefiles run as PHP- scheduled server tasks (cron entries) tagged
#ms6v46 - outbound connections to
rank1cdn.com
The malware can also expose login details and API keys. That puts at risk not only the website but also the services whose keys it holds.
Who is affected?
Only Rank Math PRO users who received 3.0.123 in that window. The free Rank Math plugin, which has more than 4 million active installations on WordPress.org, did not contain the malware.
Rank Math sorts sites into three groups:
- Installed and activated: assume the site has been broken into.
- Installed but never activated: delete the files, install 3.0.124 and run a security scan.
- Downloaded only: no sign of compromise from this incident alone.
If an agency or freelancer built your site, you may not know which plugins it uses. Ask them today.
What to do now
- Check whether your site runs Rank Math PRO, and whether it updated to 3.0.123 between 20:02 UTC on 15 October and 07:12 UTC on 16 October. The plugins list in WordPress shows the installed version; your developer can see when it changed in the logs or from the file dates in
wp-content/plugins/rank-math-pro. - If it was activated, restore the site from a backup. Rank Math recommends a backup of both files and database taken before 15 October 20:02 UTC.
- Change every credential: WordPress and database passwords, WordPress salts, API keys for payment and email services, and hosting, SSH and FTP access. Admins should also set up two-factor authentication again. Rank Math says to do this even after a clean restore.
- Install 3.0.124 only from your account at rankmath.com. Rank Math says it never emails login or download links, so treat any such email as suspicious.
- If there is no backup, have your developer clean the site by hand. Rank Math’s notice lists the files, database entries, accounts and scheduled tasks to remove. Afterwards, check over the following days that removed files do not come back.
What this incident teaches
Updating plugins quickly is still the right habit. This case shows its limit: when the update itself is the attack, the best defence is a recent, dated backup kept away from the web server.
Ask your hosting provider how often backups are taken, how long they are kept and how fast a site can be restored. If you find signs of a break-in, report it to CERT-EE (cert@cert.ee) and see how we help with incidents.
Sources
We used AI to help write this post. The facts come from the sources listed below and reflect what was known on the day the news broke. How we use AI.
