{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/rank-math-pro-3.0.123/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Rank Math PRO (3.0.123)"],"_cs_severities":["high"],"_cs_tags":["supply-chain","wordpress","plugin-compromise"],"_cs_type":"advisory","_cs_vendors":["Rank Math"],"content_html":"\u003cp\u003eBetween October 15 and October 16, 2026, attackers successfully compromised the supply chain for the Rank Math PRO WordPress plugin, specifically version 3.0.123. Users who downloaded or updated to this version during the window (20:02 UTC on October 15 to 07:12 UTC on October 16) received packages containing malicious code. Once activated, the malware grants attackers persistent administrative access, the ability to exfiltrate credentials and API keys, and creates backdoors within the compromised WordPress environment. The persistence mechanisms are multifaceted, including database modifications, fake core files, and .htaccess manipulations, making manual remediation complex. This incident underscores the risks inherent in third-party plugin updates and the potential for broad, automated compromise via supply chain vectors.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker compromises the build or distribution channel of Rank Math PRO version 3.0.123.\u003c/li\u003e\n\u003cli\u003eVictim administrator downloads or updates the plugin during the period of compromise.\u003c/li\u003e\n\u003cli\u003eActivation of the malicious plugin allows for initial execution of embedded PHP scripts.\u003c/li\u003e\n\u003cli\u003eMalware drops malicious .cache files containing PHP payloads and injects fake WordPress core files.\u003c/li\u003e\n\u003cli\u003eThe attacker modifies .htaccess files to ensure .cache files are executed as PHP code upon page visits.\u003c/li\u003e\n\u003cli\u003eMalware creates a hidden backdoor, registers persistent tasks or cron jobs, and creates unauthorized administrator accounts.\u003c/li\u003e\n\u003cli\u003eAttacker exfiltrates sensitive data including API keys, database credentials, and site secrets.\u003c/li\u003e\n\u003cli\u003ePersistent access is maintained across page loads and potential site updates via the deployed backdoors.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eVictims of this compromise face a total takeover of their WordPress websites. The malware enables the exfiltration of sensitive site data, including credentials and API keys, and establishes deep persistence that survives typical plugin removal. Impacted users must perform a full site restoration from a clean backup to ensure the removal of attacker-controlled backdoors, cron jobs, and unauthorized administrative users.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eImmediately verify the version of the Rank Math PRO plugin and update to version 3.0.124 or later if running 3.0.123.\u003c/li\u003e\n\u003cli\u003eBlock outbound traffic to the known attacker domain 'rank1cdn.com' at the network perimeter.\u003c/li\u003e\n\u003cli\u003eConduct a forensic review of the web server for unauthorized PHP files, modifications to .htaccess files, and unrecognized scheduled cron jobs.\u003c/li\u003e\n\u003cli\u003eAudit the WordPress administrative user list for unauthorized accounts created during or after the compromise window.\u003c/li\u003e\n\u003cli\u003eForce a password reset for all administrative users and rotate all API keys and secrets stored within the WordPress environment.\u003c/li\u003e\n\u003cli\u003eRestore the entire website from a known-clean backup created prior to October 15, 2026, as manual cleanup may be incomplete.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-19T16:19:10Z","date_published":"2026-10-19T16:19:10Z","id":"https://feed.craftedsignal.io/briefs/2026-10-rank-math-compromise/","summary":"Attackers compromised Rank Math PRO version 3.0.123 between October 15 and October 16, 2026, injecting malware that provides persistent administrative access, credential theft, and server-side backdoor capabilities.","title":"Supply Chain Compromise of Rank Math PRO WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-rank-math-compromise/"}],"language":"en","title":"CraftedSignal Threat Feed - Rank Math PRO (3.0.123)","version":"https://jsonfeed.org/version/1.1"}