The makers of the popular Rank Math SEO plugin have confirmed that an infected Rank Math PRO 3.0.123 build went out through their own official channels. WordPress site owners who simply clicked Update may have received a hidden entry point for attackers along with the plugin.

A fixed 3.0.124 release is already available, but the developers are upfront that it only swaps out the malicious component. Anything the backdoor created after activation stays in place and has to be cleaned up by hand.

Who is affected

The infection window was short: from October 15, 20:02 UTC to October 16, 07:12 UTC. During those 11 hours the poisoned package could be downloaded from the Rank Math site or arrive via automatic updates. The free edition on WordPress.org was not affected, and neither were PRO 3.0.123 copies fetched before that window.

Why updating is not enough

The malware can rebuild itself: when someone visits the site it recreates the backdoor, so deleting a couple of PHP files or disabling the plugin guarantees nothing. It persists in several places at once — hidden scripts, database records and cron jobs — and parts of it may hide inside other plugin and theme folders.

  • admin accounts whose names start with wpsupport_;
  • a wp-includes/class-wp-cache-util.php file;
  • connections to the rank1cdn.com domain;
  • options _uf6qdn2hmm, t8krdk990phb and _np5pvf754c in the options table.

What site owners should do

The safest route is restoring files and the database from a backup made before October 15, 20:02 UTC. A manual cleanup starts by removing the whole rank-math-pro directory and the malicious options, then checking files, accounts, cron jobs and server settings. WordPress passwords, database and hosting credentials, API keys and payment settings should be treated as exposed and rotated. If the build was downloaded but never activated, deleting it and installing 3.0.124 is enough.

Our take

Supply-chain attacks hurt precisely the careful people who update on time. For WordPress projects it is a strong case for regular, clearly dated backups, testing paid plugin updates on a staging copy first, and keeping the number of add-ons with deep access to a minimum. Details and indicators of compromise are in the SecurityLab report.