Rank Math PRO 3.0.123 Was Backdoored at the Source: An 11-Hour Window of Tainted Downloads, and Why Updating Won't Clean It

Some copies of the Rank Math PRO WordPress SEO plugin downloaded from the vendor's own website contained malware. According to BleepingComputer, the affected build is version 3.0.123, and it was served between 20:02 UTC on 15 October and 07:12 UTC on 16 October, an 11-hour window. Rank Math says a "limited number" of users were affected but has not published a count.

The free Rank Math plugin on WordPress.org, which is active on more than 4 million sites, was not affected. Only PRO downloads from the vendor's site were.

What the malware does

Per the vendor's advisory, the malicious files can compromise a site once the plugin is activated. The malware:

• establishes persistent access and communicates with the domain rank1cdn[.]com;
• recreates its hidden backdoors when someone visits the infected site, so deleting a single file does not remove it;
• can expose database credentials, API keys and other secrets available to the web server.

Rank Math has removed the affected files and released a clean build, PRO 3.0.124. Rank Math did not respond to BleepingComputer's questions about how many sites were affected or how the attackers got in, and Wordfence has also published an advisory.

A related sample, not yet confirmed

BleepingComputer found a PHP file on VirusTotal that shares indicators with Rank Math's advisory. Neither Rank Math nor Wordfence has linked it to the plugin, and it is unconfirmed that it was distributed this way. If it is related, it matters, because it appears to be a first-stage deployer that creates a backdoor at wp-includes/class-wp-cache-util.php, can run commands and modify databases, and can steal cloud credentials (AWS, Cloudflare, Google Cloud, Azure) and SSH keys.

The shared indicators:

• XOR key xmmqhn
• WordPress database entry _np5pvf754c
• Cron job marker #ms6v46
• New administrator accounts with the username prefix wpsupport_ and @wp-mail.net email addresses

Are you exposed?

You are only in scope if you downloaded Rank Math PRO 3.0.123 from the vendor's site in that window. Check the installed version and the file's download date. If you installed it but never activated it, delete it, install 3.0.124 and scan the site.

What to do if you ran 3.0.123

Deactivating or updating the plugin does not remove the threat. Rank Math's guidance:

1. Restore from a clean backup if you have one, run security scans, and rotate all passwords, keys and salts.
2. Without a clean backup, delete the entire plugin folder and the malicious database entries first, then hunt for the rest.
3. Look for persistence: unknown administrator accounts, modified files, scheduled tasks, and changes outside WordPress itself.
4. Block outbound connections to rank1cdn[.]com.
5. Treat server-side secrets as exposed. Anything the web server could read, including database credentials, API keys and cloud credentials, should be rotated.

Why this one is hard to catch

The code arrived through the vendor's normal download channel, so nothing about the install looked wrong to the person doing it. Signature checks on the plugin's source would not have helped either, because the source itself was the problem. What is left for defenders is behaviour on the host: a web server making an outbound call to a domain it has never contacted, a new administrator account appearing, a cron entry nobody wrote, or a core file under wp-includes changing.

This is the same shape as other recent incidents where a trusted channel was the delivery route. We covered a vendor application identity abused in Microsoft 365 tenants yesterday, and the earlier Plugin4Shell coding-agent case. The common thread is that trust was granted once and never re-checked.

Where Obiguard fits: logs that show what the host did next

Obiguard SOC collects logs and host metrics through OpenTelemetry and makes them searchable in Live Logs by source and level. Alerts fire on rule matches and on log volume, and each alert keeps an evidence timeline linked to the raw events behind it.

To be clear about scope: SOC works on the telemetry you send it. Web server, WordPress audit and host logs have to be forwarded as a configuration step on your side, and SOC does not remove malware or block connections for you. With those logs flowing, rules for a new wpsupport_ administrator, a request touching wp-includes/class-wp-cache-util.php, or a spike in errors after a plugin update give you an alert with evidence attached, instead of a discovery weeks later.

The question to take away

If a plugin you trust shipped a backdoor tomorrow, which log would tell you first, and is anyone reading it?

See how Obiguard SOC works or talk to us about monitoring the hosts that run your sites.