Rank Math PRO supply chain attack injects persistent backdoors into WordPress sites

1. Executive summary

Rank Math PRO, a commercial WordPress SEO plugin, shipped a malicious build of version 3.0.123 between 2026-10-15 20:02 UTC and 2026-10-16 07:12 UTC; any site that installed or updated to that version in the window and activated the plugin should be treated as compromised. The injected code gives the attacker persistent access, can recreate a hidden backdoor on each page visit, and can expose credentials, API keys and other secrets held in the WordPress install or on the host. Rank Math pulled the affected files and released a clean build, v3.0.124. No CVE has been assigned and the item carries no CVSS score, CISA KEV entry or EPSS estimate; the risk is supply-chain integrity, not a scored software flaw. For EMEA financial services the exposure is concentrated in marketing, investor-relations and regional sites running WordPress with a paid SEO plugin, where a compromised host can leak API keys and session material into an environment that may share credentials with production systems.

2. Regulatory framing

3. Technical analysis & attack chain

The compromise is a supply-chain injection: malicious code was placed inside legitimate Rank Math PRO version 3.0.123 packages and distributed through the normal update path. Rank Math states that some 3.0.123 packages contained malware that could allow attackers to take over websites once the plugin was activated. The affected distribution window is 2026-10-15 20:02 UTC to 2026-10-16 07:12 UTC. Rank Math removed the affected files and published v3.0.124 as the clean release.

Confirmed steps, as described by Rank Math via SecurityWeek:

1. A user downloads or updates Rank Math PRO to version 3.0.123 during the affected window.
2. The package contains injected malware. Activation of the plugin is the condition under which the code can run.
3. On execution the malware establishes persistent access to the site and can expose credentials, API keys and other secrets.
4. The malware can recreate a hidden backdoor on each page visit, so removing the visible implant once does not clear the compromise.
5. The malware can write outside the plugin directory: fake WordPress core files, modified .htaccess rules, dropped .cache files containing PHP, scheduled tasks and cron jobs, and changes to other plugins and themes.
6. The attacker can act outside the WordPress installation, including via SSH authorized_keys files, crontabs belonging to other system users, and any location the web server user can write to.

Persistence and execution detail. The .htaccess modification adds rules that cause .cache files to be executed as PHP, and the malware drops .cache files containing PHP code to match. That pairing is the mechanism a defender should hunt for: a rewrite rule that maps .cache to the PHP handler, plus .cache files that contain PHP. The malware also schedules tasks and cron jobs and modifies other plugins and themes, which gives it several independent footholds. Rank Math says the backdoor can be recreated on each page visit, which means a file-level cleanup that misses the recreation trigger will not hold.

Scope of impact. Rank Math's guidance is that affected sites should be treated as compromised and restored from a clean backup taken before the incident. Where a backup is not available, the vendor's manual cleanup covers deleting the Rank Math PRO plugin folder, removing a malicious database entry, blocking the attacker domain rank1cdn[.]com, and finding and removing suspicious PHP files and unknown administrator accounts. The vendor also directs admins to check SSH authorized_keys files, crontabs of other system users, suspicious processes, and other paths writable by the web server user.

Unconfirmed and single-sourced points. Every technical detail above rests on Rank Math's statement as reported by SecurityWeek; Adverse Trace has not independently reviewed the malicious package, and no hash, filename, database table or key name, cron entry or .htaccess rule text is given in the source. The specific malicious database entry is not identified. No CVE has been assigned, no CVSS score exists, and there is no CISA KEV or EPSS data. No threat actor is named and no attribution is possible from this material. Treat the full IOC and behaviour set as single-sourced and verify against the affected host before enforcing blocks.

4. Mitigation & containment

P1 within 24 hours

• Identify every WordPress install running Rank Math PRO. Query the plugin version from the filesystem or WP-CLI (wp plugin list --name=seedprod 2>/dev/null; wp plugin get rank-math-pro --field=version where WP-CLI is available) and flag any install that recorded version 3.0.123 between 2026-10-15 20:02 UTC and 2026-10-16 07:12 UTC.
• For any site that installed and activated 3.0.123 in the window, treat it as compromised. Take it out of service or place it behind a maintenance block, and restore from a backup created before 2026-10-15 20:02 UTC. Do not attempt in-place cleanup first; the vendor states the backdoor can be recreated on each page visit.
• Block rank1cdn[.]com at DNS and egress filtering across the estate, not only on the affected host.
• Rotate every credential reachable from the affected host: WordPress admin and database accounts, API keys stored in the plugin or wp-config, SSH keys, and any secrets in environment files. Rotate after the host is confirmed clean, and treat any key that was present on the host as exposed.

P2 within 72 hours

• Where no clean backup exists, follow the vendor's manual sequence: delete the Rank Math PRO plugin folder, remove the malicious database entry (Rank Math has not published the table or key; obtain it from the vendor before deleting rows), remove unknown administrator accounts, and search for and remove suspicious PHP files.
• Hunt for the .htaccess to .cache execution pattern: grep .htaccess files for rewrite or handler rules that route .cache to PHP, and list .cache files containing PHP opening tags under the web root.
• Check for persistence outside the web root: SSH authorized_keys files for the web user and other accounts, crontabs for all system users (for u in $(cut -d: -f1 /etc/passwd); do crontab -l -u $u 2>/dev/null; done), systemd timers, and any file the web server user can write to.
• Compare WordPress core files against a known-good release to find fake core files, and diff other plugins and themes against vendor originals.

P3 within 7 days

• Install Rank Math PRO v3.0.124 or later on every site, and pin the plugin version in your deployment tooling so an unexpected build cannot be pulled silently.
• Add integrity checking for plugin and theme packages (checksum verification against the vendor's published release) to the deployment pipeline.
• Review supplier contracts and monitoring for plugin and hosting providers against the DORA Art. 28 and Art. 30 points in section 2.

5. Indicators of compromise

No hashes, IP addresses, filenames of the malicious package files, database table or key names, cron entry text or .htaccess rule text are given in the source. The only atomic network indicator is the domain above.

domain  rank1cdn[.]com

Behavioural indicators

6. Detection

The source gives one usable atomic artefact (the domain) and a set of behaviours. A YARA rule built only on the domain string would be weak; the rule below targets the .cache-as-PHP execution pattern and the domain reference where they appear in web content, which is the closest thing to a threat artefact the source supports. Verify against a known sample before deploying, since no sample hash is available.

rule WordPress_Cache_PHP_Backdoor_RankMath
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-19"
        reference = "https://www.securityweek.com/rank-math-pro-wordpress-plugin-compromised-in-supply-chain-attack/"
        description = "Detects .htaccess rules routing .cache files to PHP and .cache files containing PHP, the persistence pattern reported in the Rank Math PRO 3.0.123 supply chain compromise"
    strings:
        $htaccess_cache = ".cache" nocase
        $php_handler   = "application/x-httpd-php" nocase
        $php_open      = "<?php"
        $domain        = "rank1cdn.com" nocase
    condition:
        (uint32(0) == 0x70616870 or $php_open) and
        (
            ($htaccess_cache and $php_handler) or
            ($htaccess_cache and $php_open) or
            $domain
        )
}

title: Rank Math PRO 3.0.123 supply chain compromise indicators
id: 7f3c2a10-9b4e-4d21-8a55-1c0e6f2b9d47
status: experimental
description: Detects web server writes of .cache PHP files, .htaccess handler changes for .cache, and DNS or proxy lookups to the reported attacker domain
author: Adverse Trace
date: 2026/10/19
references:

    - https://www.securityweek.com/rank-math-pro-wordpress-plugin-compromised-in-supply-chain-attack/
logsource:
    category: file_event
    product: linux
detection:
    cache_php_write:
        TargetFilename|endswith: '.cache'
    htaccess_write:
        TargetFilename|endswith: '.htaccess'
    selection:

        - cache_php_write
        - htaccess_write
    condition: selection
fields:

    - Image
    - TargetFilename
    - User
falsepositives:

    - Legitimate caching plugins that write .cache files without PHP content; confirm file contents before alerting
level: high
---
title: DNS or proxy lookup to rank1cdn.com
id: 2b8e4c61-5a0d-4f77-9e13-6d2a0c8b1f34
status: experimental
description: Detects resolution of or connection to the attacker domain named in the Rank Math PRO compromise
author: Adverse Trace
date: 2026/10/19
references:

    - https://www.securityweek.com/rank-math-pro-wordpress-plugin-compromised-in-supply-chain-attack/
logsource:
    category: dns
detection:
    selection:
        QueryName|endswith: 'rank1cdn.com'
    condition: selection
falsepositives:

    - None expected; the domain is named by the vendor as attacker-controlled
level: critical

7. Sources

• SecurityWeek, "Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack", https://www.securityweek.com/rank-math-pro-wordpress-plugin-compromised-in-supply-chain-attack/, 2026-10-19. Single source for all technical detail; the underlying statement is Rank Math's.

8. Adverse Trace position

Adverse Trace assesses this as a supply-chain integrity compromise with high impact on affected hosts and no scored severity: no CVE, no CVSS, no CISA KEV and no EPSS data exist for it, and the vendor's own guidance is to treat any site that activated 3.0.123 in the window as compromised and restore from backup. The technical detail is single-sourced to Rank Math via SecurityWeek and no atomic indicators beyond the domain rank1cdn[.]com are published, so we will not issue hash or file-based blocks until we have reviewed a sample. Client impact is highest where WordPress marketing or regional sites hold API keys or credentials shared with production systems; those keys should be treated as exposed. We will monitor for Rank Math's publication of the malicious database entry, package hashes and .htaccess rule text, update this advisory when they appear, and contact clients running Rank Math PRO to confirm version state and backup availability.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.