Rank Math PRO update was trojanized to backdoor WordPress sites

Attackers injected malware into version 3.0.123 of Rank Math PRO, the premium edition of a popular WordPress SEO plugin, turning a routine update into a backdoor for site takeover, SecurityWeek reported on October 19. According to the report, the tainted packages were distributed between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026. Rank Math says it has pulled the affected files and shipped a clean release.

What happened

The compromise affects only Rank Math PRO 3.0.123 packages that were downloaded or updated during that roughly 11-hour window, SecurityWeek said. Once the plugin was activated, the injected code could let attackers take over the website. "We immediately removed the affected files and released a clean version, Rank Math PRO v3.0.124," the company said, as quoted by SecurityWeek.

The report does not say how the attackers gained access to the distribution channel, who was behind the attack, or how many sites installed the poisoned version.

Technical details

According to SecurityWeek, the malware may provide persistent access to the site and expose credentials, API keys and other secrets stored in the installation. It may recreate a hidden backdoor on every page visit, which can make manual cleanup difficult.

The malicious code may also deploy fake WordPress core files, modify .htaccess so that .cache files are executed as PHP, drop PHP-bearing .cache files, create scheduled tasks and cron jobs, tamper with other plugins and themes, and upload additional files. SecurityWeek noted that the changes may reach beyond the WordPress installation to the underlying server. The domain rank1cdn[.]com is listed as part of the malicious infrastructure.

Who is affected

Any WordPress site that installed and activated Rank Math PRO 3.0.123 during the distribution window is at risk. Sites that updated before 20:02 UTC on October 15 or after 07:12 UTC on October 16, or that went straight to 3.0.124, are not affected by this specific package, based on the timeline in the report. The free Rank Math plugin is not mentioned as affected.

What to do

Sites that installed and activated 3.0.123 during the window should be treated as compromised and restored from a clean backup made before the incident, according to the guidance cited by SecurityWeek. Where no clean backup exists, administrators should:

• delete the Rank Math PRO plugin folder and remove the malicious database entry;
• block the domain rank1cdn[.]com;
• hunt for and remove suspicious PHP files and unknown administrator accounts;
• check the server for unfamiliar SSH authorized_keys entries, crontabs belonging to other system users, suspicious processes and other locations writable by the web server user.

Only after confirming the site is clean should administrators change all passwords, rotate API keys and secrets, and install Rank Math PRO 3.0.124 or later.