Hackers Slipped a Backdoor Into Rank Math PRO for 11 Hours, and Updating the Plugin Won't Remove It

For about 11 hours last week, anyone who downloaded Rank Math PRO from the vendor's own website got a poisoned copy. Version 3.0.123 of the paid WordPress SEO plugin, pulled between October 15 at 20:02 UTC and October 16 at 07:12 UTC, carried malware that plants a hidden backdoor, rebuilds it every time someone visits the site and puts database credentials, API keys and other secrets within the attackers' reach.

The download channel itself was the weapon. Site owners did the right thing by getting the plugin straight from the source, and that trust was what the attackers used. Rank Math also says the usual reflex of updating or switching the plugin off is not enough to get rid of it.

What the malware does

In its security advisory, Rank Math says the issue affected "a limited number of users" and that the files "contained malware that could compromise your website if the plugin was activated." It pulled the files and shipped a clean v3.0.124.

The cleanup is the hard part. The malware can recreate its hidden backdoor whenever someone visits the site, so deactivating the plugin does nothing on its own. It may create admin accounts with usernames starting with wpsupport_ and emails ending in @wp-mail.net, drop a fake core file at wp-includes/class-wp-cache-util.php, rewrite .htaccess so .cache files run as PHP, and add cron jobs tagged #ms6v46. It can also tamper with other plugins and themes and reach outside WordPress entirely, into SSH authorized_keys and other users' crontabs. That persistence could make manual cleanup difficult, SecurityWeek noted.

The free plugin, which runs on more than 4 million websites, is not affected. Neither is anyone who downloaded the PRO build in that window but never installed it.

A sample that steals cloud keys

BleepingComputer found a PHP file on VirusTotal named "cache-preloader-fff033 (1).php" that shares the advisory's fingerprints, including the #ms6v46 cron marker and the wpsupport_ account creation. It looks like a first stage that installs the class-wp-cache-util.php backdoor, runs commands, edits WordPress databases, and steals AWS, Cloudflare, Google Cloud and Azure credentials along with SSH keys. BleepingComputer could not confirm that this sample was distributed through the plugin.

Rank Math has not said how many sites were hit or how the attackers got in. It had not answered BleepingComputer's questions on either point when that story ran, and no group has been named.

What admins have to do

Anyone who activated the bad build should treat the site as compromised. Rank Math says to restore the site and database from a backup made before October 15 at 20:02 UTC, scan with a tool like Wordfence or Sucuri, and assume every secret is exposed: passwords, database credentials, WordPress keys and salts, payment gateway and SMTP credentials, API keys, and hosting, FTP and SSH logins all need rotating. The whole rank-math-pro folder has to go, along with the malicious wp_options entries, and outgoing connections to rank1cdn.com should be blocked. A site that installed but never activated it needs the plugin deleted, 3.0.124 installed and a scan.

Collateral damage for free users

The response had a side effect. Rank Math did a "system refresh" on rankmath.com that removed free accounts registered between October 13 and 16. Those users got emails asking them to re-create their accounts. Their plugin keeps working, but Search Console and Analytics data, the rank tracker and Rank Math AI stop until they reconnect. Some PRO users may also need to reset passwords.

Rank Math adds that it never emails login or download links, so any unexpected reset or download message should be treated as suspicious. For a company whose own download page just served malware, that warning carries weight. It is the same lesson as the npm attack that poisoned 1,500 packages through trusted publishing: the official channel is only as safe as the systems behind it.

Some offers on this page may be paid placements or contain affiliate links.