Malicious Rank Math PRO Update Could Leave WordPress Sites Backdoored

A trusted WordPress plugin update became a potential route for website compromise after attackers distributed malware-infected copies of Rank Math PRO.

Rank Math says some copies of its paid plugin, version 3.0.123, downloaded or updated between Oct. 15 and Oct. 16 contained malicious code that could compromise websites when activated. 

The company says it removed the affected files and released version 3.0.124, but updating alone may not remove leftovers from the infection.

The incident highlights a supply-chain risk for organizations that depend on third-party software: even when administrators obtain a plugin from its official source, they may still be exposed if the vendor's distribution process is compromised.

What happened?

Rank Math is a popular WordPress search engine optimization (SEO) plugin that helps website owners improve their visibility in search results.

BleepingComputer, citing WordPress stats, says the free plugin has more than four million active installations, while Rank Math PRO offers paid features. However, the recent security incident affected the PRO version. Rank Math has not published the number of affected PRO users.

In a security notice, Rank Math disclosed that some copies of Rank Math PRO version 3.0.123 contained malware. The affected copies were downloaded between Oct. 15 at 20:02 UTC and Oct. 16 at 07:12 UTC, an 11-hour, 10-minute window. Rank Math said it has removed the affected files and released a clean version, 3.0.124.

The malware could compromise a website if the affected plugin were activated. More concerningly, it could recreate its hidden backdoor whenever someone visited an infected website, meaning removing individual malicious files without first stopping the mechanism that restores them might not resolve the compromise.

Rank Math warned that website owners who activated an affected copy should assume that sensitive information accessible to the web server may have been exposed. 

Exposed information may include passwords, database credentials, security keys and salts stored in wp-config.php, gateway keys, and SMTP credentials. Others include API keys, hosting control panel credentials, FTP, SFTP, and SSH access credentials, and secrets stored in environment variables.

What this incident means for organizations with websites

For organizations that depend on their websites to attract customers, publish information, or conduct business, the immediate concern is website integrity. A compromised plugin can also become a route to wider system access.

Depending on what the website does and what the attackers access, this could disrupt operations, expose sensitive information, or undermine customer trust. These are potential consequences of the reported malware, not confirmation that every affected website suffered them.

The risk also extends beyond the website itself. If attackers obtain credentials or API keys stored on the server, they may use those secrets to access connected services, depending on the permissions attached to them. For businesses, this makes it important to assess not only the compromised website but also the external accounts and systems that it can access.

The incident also highlights a difficult supply-chain risk: even software distributed through official vendor channels can become a source of compromise.

Administrators generally install updates to fix problems and keep their websites secure. But when a software distribution channel is compromised, an update can introduce malicious code instead. Once that code executes, installing a clean version may not remove the other changes it made.

The lesson is not to stop updating plugins from the official vendor. It is to combine timely updates with reliable backups, monitoring for unauthorized changes, careful credential control, and a recovery process that accounts for compromise beyond the original software.

Here’s what you can do now

Organizations using Rank Math PRO should first determine whether they downloaded or updated version 3.0.123 during the affected period.

If you did and activated the affected plugin, Rank Math advises you to assume your website may be compromised. The company recommends restoring your website files and database from a clean backup created before the incident window. If you don't have one, follow its manual cleanup instructions. Simply updating the plugin is not enough.

For those who installed the plugin outside this window, or installed it but did not activate it, the company has not established that they are compromised. However, Rank Math still advises users to delete the existing PRO plugin installation and install the clean version, 3.0.124. 

Administrators who are unsure when the plugin was downloaded or activated should review their installation history and investigate suspicious changes. They can also contact Rank Math at support@rankmath.com for assistance.

Other news: Microsoft has confirmed that its October Windows Server security updates can disrupt on-premises Exchange Server deployments, causing email delivery delays, failed webmail sign-ins, and mailbox availability issues.