Rank Math PRO Plugin Compromised in Supply-Chain Attack

WordPress SEO plugin Rank Math PRO was compromised in a supply-chain attack between October 15, 2026, 20:02 UTC and October 16, 2026, 07:12 UTC, leading to the distribution of malware-infected versions of its software with a critical CVSS score of 9.8[1][9]. The incident means that a limited number of users who downloaded and activated the affected software during this window risk having their websites exploited, potentially leading to the exposure of sensitive data like passwords and API keys, and persistent attacker access[2][7][12].

What the records show

Malicious code was embedded within a subset of downloads for Rank Math PRO version 3.0.123, distributed from the official vendor website[1][6]. This incident has been assigned CVE-2026-111862, carrying a critical CVSS score of 9.8[9]. The malware was designed to establish persistent backdoors on compromised websites[7]. Upon activation, the malicious plugin could communicate with an attacker-controlled domain, rank1cdn.com, and recreate hidden backdoors whenever an infected site was visited[7][8]. Registry records indicate the domain rank1cdn.com was registered on October 14, 2026, approximately one day before the compromise window began[10][13].

The malware had capabilities to expose a wide array of sensitive information, including WordPress passwords, database credentials, API keys, security keys and salts stored in wp-config.php, payment gateway keys, SMTP credentials, hosting control panel access, and FTP/SFTP/SSH credentials[7][12]. Beyond data exfiltration, the malware could also create unauthorized administrator accounts, often with usernames prefixed wpsupport_ or email addresses ending in @wp-mail.net[7][12]. It was also capable of dropping fake WordPress core files, such as wp-includes/class-wp-cache-util.php, modifying .htaccess files to execute .cache files as PHP, adding malicious entries to the WordPress options table (_uf6qdn2hmm, t8krdk990phb, _np5pvf754c), and scheduling system cron jobs tagged #ms6v46[7][12]. Attackers could also make changes outside the WordPress installation, modifying SSH authorized_keys files or other system users' crontabs[7][12].

The Timeline

The domain rank1cdn.com, implicated in the attack, was registered on October 14, 2026[10][13]. The distribution of malicious software began on October 15, 2026, at 20:02 UTC[1][2]. This window of compromise continued until October 16, 2026, at 07:12 UTC, lasting 11 hours and 10 minutes[1][3]. Rank Math officially acknowledged the security issue on October 16, 2026[2][10]. The company then removed the affected files and released a clean version, Rank Math PRO v3.0.124, on the same day[2][3].

What changed and for whom

Rank Math clarified that only users of the premium Rank Math PRO plugin were affected by this incident[2][5]. The free version of the plugin, available on WordPress.org, remained secure and its users require no action[2][5]. Rank Math stated that several hundred customers downloaded a compromised copy of its PRO plugin[13]. For users who downloaded or updated to version 3.0.123 during the affected 11-hour, 10-minute window, Rank Math provided detailed recovery steps[2][3]. If version 3.0.123 was installed and activated during the compromise window, the website should be treated as compromised[2][6]. If the plugin was installed but not activated, users are advised to delete affected files, install the clean version 3.0.124, and run a security scan[2][6]. If only downloaded but not installed or activated, no compromise is indicated from this incident alone[2][12].

Recommended recovery actions for compromised sites include restoring from a clean backup created before October 15, 2026, at 20:02 UTC, running a security scan with tools like Wordfence or Sucuri, changing all passwords and credentials, and installing the clean version 3.0.124[2][7]. For manual cleanup without a clean backup, steps involve deleting the entire rank-math-pro directory, removing specific malicious entries from the WordPress options table (_uf6qdn2hmm, t8krdk990phb, _np5pvf754c), blocking outbound connections to rank1cdn.com, and meticulously searching for and removing suspicious files, unauthorized administrator accounts, modified .htaccess files, and scheduled tasks[5][7].

What Rank Math said

Rank Math acknowledged the security issue on October 16, 2026, stating that the affected files were immediately removed and a clean version, Rank Math PRO v3.0.124, was released[2][3]. The company clarified that only users of the premium Rank Math PRO plugin were affected, while the free version available on WordPress.org remained secure[2]. Rank Math Operations Director Uzair Nazeer stated, "We know how much our customers rely on Rank Math, and we apologize for the worry this has caused. Our team is here to help anyone who's been affected"[13]. The company also provided detailed recovery steps to its users[2].

What we could not confirm

PrimaryBrief could not confirm how the malicious files entered Rank Math’s download and update system[10]. It is also unconfirmed whether automatic updates delivered the malware[10]. The hashes of the clean and tainted packages have not been publicly disclosed[10].