Users downloaded a malicious version of Rank Math PRO last week, after the WordPress SEO plugin was compromised in a supply chain attack.
Some version 3.0.123 packages contain malware that can allow attackers to take over websites if the plugin is enabled, Rank Math said.
All users who download or update their plugins to the affected version between October 15, 2026, 20:02 UTC and October 16, 2026, 07:12 UTC may be infected.
“We immediately removed the affected files and released a clean version, Rank Math PRO v3.0.124,” said Rank Math.
All users who installed and activated plugin version 3.0.123 during the affected window should treat their websites as compromised and should restore them from a clean backup created before the incident.
Malware may give attackers constant access to compromised websites and can reveal credentials, API keys and other secrets.
According to Rank Math, malware may create a hidden backdoor on each page visit, and its persistence mechanism can make self-cleaning a difficult task.
Users who are unable to restore the site from backup should delete the Rank Math PRO plugin folder, remove malicious database entries, block the attacker’s rank1cdn..com domain, and find and delete suspicious PHP files and unknown administrator accounts.
Malware may use fake WordPress core files, edit .htaccess files to add rules for .cache files to execute as PHP code, place .cache files with PHP code, schedule jobs and cron jobs, modify plugins and other themes, and upload other files.
Additionally, attackers can make changes outside of the WordPress installation, and site administrators should look for SSH authorized_keys files, crontabs from other system users, suspicious processes, and other places where web server users have write access.
After verifying the website is clean, users should change all their passwords and install the clean version of Rank Math PRO.
Related: Plex2Shell Exploit Chain Weaponized Against Plex Servers After Disclosure
Related: Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution
Related: Chrome, Firefox Updates Patch 114 Bugs While Mozilla Unveils Firefox Enterprise
Related: Citrix, Fortinet, Ivanti Patch 29 vulnerabilities across their products
