Users downloaded malicious versions of Rank Math PRO last week, after the WordPress SEO plugin was compromised in a supply chain attack.
Some version 3.0.123 packages contained malware that could allow attackers to take over websites if the plugin was activated, Rank Math says.
All users who downloaded or updated their plugin to the affected version between October 15, 2026, at 20:02 UTC and October 16, 2026, at 07:12 UTC might have been infected.
“We immediately removed the affected files and released a clean version, Rank Math PRO v3.0.124,” Rank Math says.
All users who installed and activated version 3.0.123 of the plugin during the affected window should treat their websites as compromised and should restore them from a clean backup created before the incident.
The malware may provide the attackers with persistent access to the compromised websites and could expose credentials, API keys, and other secrets.
According to Rank Math, the malware may recreate a hidden backdoor upon each page visit, and its persistence mechanism could make manual cleanup a difficult task.
Users who cannot restore the site from a backup should delete the Rank Math PRO plugin folder, remove a malicious database entry, block the attacker’s domain rank1cdn[.]com, and find and remove suspicious PHP files and unknown administrator accounts.
The malware may also deploy fake WordPress core files, modify .htaccess files to add rules for .cache files to execute as PHP code, drop .cache files containing PHP code, schedule tasks and cron jobs, modify other plugins and themes, and upload other files.
Additionally, the attackers could make changes outside the WordPress installation, and site admins should also look for SSH authorized_keys files, crontabs from other system users, suspicious processes, and other locations the web server user has write access to.
After verifying the website is clean, users should change all their passwords and install a clean version of Rank Math PRO.
Related: Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure
Related: Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution
Related: Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise
Related: Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products
