Malware Found in Rank Math PRO Plugin for WordPress, Putting Websites at Risk of Backdoor Compromise

571/69 Tuesday, October 20, 2026 The developer of a WordPress plugin has confirmed that some Rank Math PRO download files distributed through its official website were modified with malware in a supply chain attack. Users who downloaded version 3.0.123 between 20:02 UTC on October 15 and 07:12 UTC on October 16 may have received a tampered package capable of compromising websites once the plugin was activated. The developer stated that only a limited number of users were affected, removed the compromised files, and released a safe version, 3.0.124. The incident affected only the paid PRO version, while the free version available through WordPress.org, which is used by more than four million websites, was not affected. Once activated, the malicious code establishes persistent communications with the malicious domain rank1cdn[.]com and recreates a backdoor whenever a visitor accesses an infected website. This places sensitive information stored on the web server, including database passwords, API keys, and other secrets, at significant risk of exposure. Initial analysis identified malicious scripts associated with the incident that attempted to create unauthorized administrator accounts using usernames beginning with wpsupport_ and email addresses under the @wp-mail.net domain. The malware was also capable of executing commands to modify the WordPress database and stealing credentials associated with various cloud services. The developer has removed the compromised files and released the safe version 3.0.124. Administrators who activated the plugin during the affected period should restore their websites from a known-good backup and rotate all passwords, credentials, and system keys. If no clean backup is available, simply disabling or updating the plugin will not remove the malware. Administrators should completely remove the affected plugin directory, inspect and clean suspicious database entries, delete unauthorized administrator accounts, and block outbound connections to the malicious domain to reduce the risk of continued or repeated compromise.