Affected Systems

Rank Math PRO version 3.0.123 downloaded from the official vendor website between October 15, 2026 20:02 UTC and October 16, 2026 07:12 UTC (11-hour window). Free version of Rank Math SEO unaffected. Rank Math free version is active on over 4 million sites; PRO user count unknown.

Exploitation Status

Active supply-chain attack. Malicious version distributed from official vendor website. Malware establishes persistent backdoors, communicates with rank1cdn[.]com, and recreates hidden access on site visits. Exposes database credentials, API keys, AWS, Cloudflare, Google Cloud, Azure credentials, and SSH keys.

Business Impact

Sites that installed and activated the compromised plugin version should be treated as fully compromised. Attackers gain persistent access with ability to execute commands, modify databases, create rogue admin accounts (wpsupport_* usernames), and exfiltrate credentials. Backdoors persist even after plugin deactivation or update. Initial infection vector not disclosed by vendor. No CVE assigned.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately identify all WordPress sites running Rank Math PRO and verify installation date/time against the October 15-16, 2026 compromise window
  • For confirmed compromised sites: restore from clean backups predating October 15, 2026; if no backup exists, delete entire Rank Math PRO plugin folder and manually remove malicious database entries '_np5pvf754c' and cron job '#ms6v46'
  • Search for backdoor files 'wp-includes/class-wp-cache-util.php' and 'cache-preloader-fff033*.php'; hunt for unauthorized admin accounts with 'wpsupport_' prefix and '@wp-mail.net' email domains
  • Block outbound connections to rank1cdn[.]com at firewall/WAF level; rotate all WordPress passwords, database credentials, API keys, wp-config.php salts, and cloud provider credentials (AWS, Azure, GCP, Cloudflare)
  • Update to clean Rank Math PRO version 3.0.124; run full security scans with Wordfence or similar; monitor for suspicious scheduled tasks and file modifications outside WordPress directories