Defenders must identify the presence of unauthorized administrative accounts, malicious files within the WordPress core, PHP-executable files within cache directories, and specific entries within the WordPress options table. Rank Math has released version 3.0.124 as a clean replacement. Organizations that deployed the affected package during the specified window are advised to treat the underlying server and WordPress environment as fully compromised.

Attack Chain

1. Attacker gains unauthorized access to the distribution channel and injects malicious code into the Rank Math SEO PRO 3.0.123 plugin package.
2. The malicious package is downloaded or updated onto target WordPress installations via the standard plugin management interface.
3. Malware activates upon plugin initialization and execution within the web server environment.
4. The malware creates hidden PHP backdoors and modifies WordPress core files to ensure persistence.
5. The payload establishes communication with the C2 domain rank1cdn[.]com for instructions.
6. The malware harvests WordPress credentials, database credentials, and API keys stored in the web server environment.
7. The malware creates unauthorized administrative accounts or adds malicious keys to the 'wp_options' table to maintain control.
8. The attacker executes arbitrary commands and exfiltrates data from the compromised environment.

Impact

The compromise provides attackers with full administrative control over affected WordPress sites. Impacted organizations are at risk of data exfiltration (including database contents and configuration secrets), unauthorized site modifications, and persistent unauthorized access. Sites that activated the affected package are considered fully compromised, necessitating a complete forensic audit and security credential rotation.

Recommendation

• Identify any WordPress site that installed or updated the Rank Math SEO PRO plugin during the window of October 15, 2026 (20:02 UTC) through October 16, 2026 (07:12 UTC).
• Upgrade to Rank Math SEO PRO version 3.0.124 or later immediately.
• Search for unauthorized administrative users in the WordPress database and audit the wp_options table for unexpected keys associated with the plugin incident.
• Scan file systems for hidden PHP backdoors, fake WordPress core files, and files with a .cache extension that contain PHP code.
• Block traffic to rank1cdn.com at the network perimeter (firewall/DNS).
• Rotate all credentials accessible to the web server, including database passwords, WordPress admin accounts, and API keys.