Rank Math PRO (3.0.123) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/rank-math-pro-3.0.123/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 19 Oct 2026 16:19:10 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSupply Chain Compromise of Rank Math PRO WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-10-rank-math-compromise/Mon, 19 Oct 2026 16:19:10 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-rank-math-compromise/Attackers compromised Rank Math PRO version 3.0.123 between October 15 and October 16, 2026, injecting malware that provides persistent administrative access, credential theft, and server-side backdoor capabilities.Between October 15 and October 16, 2026, attackers successfully compromised the supply chain for the Rank Math PRO WordPress plugin, specifically version 3.0.123. Users who downloaded or updated to this version during the window (20:02 UTC on October 15 to 07:12 UTC on October 16) received packages containing malicious code. Once activated, the malware grants attackers persistent administrative access, the ability to exfiltrate credentials and API keys, and creates backdoors within the compromised WordPress environment. The persistence mechanisms are multifaceted, including database modifications, fake core files, and .htaccess manipulations, making manual remediation complex. This incident underscores the risks inherent in third-party plugin updates and the potential for broad, automated compromise via supply chain vectors.

Attack Chain

  1. Attacker compromises the build or distribution channel of Rank Math PRO version 3.0.123.
  2. Victim administrator downloads or updates the plugin during the period of compromise.
  3. Activation of the malicious plugin allows for initial execution of embedded PHP scripts.
  4. Malware drops malicious .cache files containing PHP payloads and injects fake WordPress core files.
  5. The attacker modifies .htaccess files to ensure .cache files are executed as PHP code upon page visits.
  6. Malware creates a hidden backdoor, registers persistent tasks or cron jobs, and creates unauthorized administrator accounts.
  7. Attacker exfiltrates sensitive data including API keys, database credentials, and site secrets.
  8. Persistent access is maintained across page loads and potential site updates via the deployed backdoors.

Impact

Victims of this compromise face a total takeover of their WordPress websites. The malware enables the exfiltration of sensitive site data, including credentials and API keys, and establishes deep persistence that survives typical plugin removal. Impacted users must perform a full site restoration from a clean backup to ensure the removal of attacker-controlled backdoors, cron jobs, and unauthorized administrative users.

Recommendation

  1. Immediately verify the version of the Rank Math PRO plugin and update to version 3.0.124 or later if running 3.0.123.
  2. Block outbound traffic to the known attacker domain 'rank1cdn.com' at the network perimeter.
  3. Conduct a forensic review of the web server for unauthorized PHP files, modifications to .htaccess files, and unrecognized scheduled cron jobs.
  4. Audit the WordPress administrative user list for unauthorized accounts created during or after the compromise window.
  5. Force a password reset for all administrative users and rotate all API keys and secrets stored within the WordPress environment.
  6. Restore the entire website from a known-clean backup created prior to October 15, 2026, as manual cleanup may be incomplete.
]]>highadvisorysupply-chainwordpressplugin-compromise