Rank Math PRO downloads carried persistent WordPress backdoors

A WordPress administrator updating a paid search-optimization plugin could instead activate malware during an eleven-hour window in October. Rank Math confirmed that its PRO version 3.0.123 contained malicious files distributed between October 15 at 20:02 UTC and October 16 at 07:12 UTC. The free WordPress.org edition was unaffected.

The vendor separated downloading the archive from activating the plugin. A downloaded file alone did not establish a compromised website. Activation mattered because it gave the malicious PHP code a place to run inside WordPress, under the same server account used by the legitimate site.

The resulting infection could outlast the plugin installation. Rank Math's cleanup instructions described database entries and hidden backdoor files that could be recreated when someone visited the website. Simply deleting one suspicious file could leave the mechanism that restored it intact. The vendor also directed responders to inspect unauthorized accounts and other changes.

Rank Math removed the affected files and issued clean version 3.0.124. For sites where the malicious plugin had been activated, it recommended restoring a pre-incident backup or performing a broader cleanup and replacing exposed credentials. The advisory did not establish the initial intrusion method or a numerical count of compromised sites.