Rank Math PRO WordPress plugin backdoored in supply chain attack

· Cybersecurity

Copies of the paid Rank Math PRO WordPress SEO plugin downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, the vendor said in a security notice published October 16. The compromise planted hidden, self-restoring backdoors in affected sites, according to researchers. Any site that installed and activated the affected version 3.0.123 packages during that window should be treated as compromised. Rank Math is a widely installed SEO plugin, so a poisoned official download channel reaches administrators who had no reason to distrust the vendor. The immediate effect is that site owners must check whether they received the affected build and remediate their installations.

Why it matters：Supply chain attacks that poison a vendor's own download and update channel bypass user trust entirely, and WordPress plugins' huge install base makes such compromises a recurring, high-leverage threat.

Key points

  • Affected packages were version 3.0.123, distributed over a roughly 11-hour window.
  • The malware established self-restoring backdoors on infected sites.
  • The vendor published its security notice on October 16.

Sources (original reporting)

More stories from this day