Defenders must identify the presence of unauthorized administrative accounts, malicious files within the WordPress core, PHP-executable files within cache directories, and specific entries within the WordPress options table. Rank Math has released version 3.0.124 as a clean replacement. Organizations that deployed the affected package during the specified window are advised to treat the underlying server and WordPress environment as fully compromised.

Attack Chain

1. Attacker gains unauthorized access to the distribution channel and injects malicious code into the Rank Math SEO PRO 3.0.123 plugin package.
2. The malicious package is downloaded or updated onto target WordPress installations via the standard plugin management interface.
3. Malware activates upon plugin initialization and execution within the web server environment.
4. The malware creates hidden PHP backdoors and modifies WordPress core files to ensure persistence.
5. The payload establishes communication with the C2 domain rank1cdn[.]com for instructions.
6. The malware harvests WordPress credentials, database credentials, and API keys stored in the web server environment.
7. The malware creates unauthorized administrative accounts or adds malicious keys to the 'wp_options' table to maintain control.
8. The attacker executes arbitrary commands and exfiltrates data from the compromised environment.

Impact

The compromise provides attackers with full administrative control over affected WordPress sites. Impacted organizations are at risk of data exfiltration (including database contents and configuration secrets), unauthorized site modifications, and persistent unauthorized access. Sites that activated the affected package are considered fully compromised, necessitating a complete forensic audit and security credential rotation.

Recommendation

• Identify any WordPress site that installed or updated the Rank Math SEO PRO plugin during the window of October 15, 2026 (20:02 UTC) through October 16, 2026 (07:12 UTC).
• Upgrade to Rank Math SEO PRO version 3.0.124 or later immediately.
• Search for unauthorized administrative users in the WordPress database and audit the wp_options table for unexpected keys associated with the plugin incident.
• Scan file systems for hidden PHP backdoors, fake WordPress core files, and files with a .cache extension that contain PHP code.
• Block traffic to rank1cdn.com at the network perimeter (firewall/DNS).
• Rotate all credentials accessible to the web server, including database passwords, WordPress admin accounts, and API keys.

Attack Chain

1. Attacker compromises the build or distribution channel of Rank Math PRO version 3.0.123.
2. Victim administrator downloads or updates the plugin during the period of compromise.
3. Activation of the malicious plugin allows for initial execution of embedded PHP scripts.
4. Malware drops malicious .cache files containing PHP payloads and injects fake WordPress core files.
5. The attacker modifies .htaccess files to ensure .cache files are executed as PHP code upon page visits.
6. Malware creates a hidden backdoor, registers persistent tasks or cron jobs, and creates unauthorized administrator accounts.
7. Attacker exfiltrates sensitive data including API keys, database credentials, and site secrets.
8. Persistent access is maintained across page loads and potential site updates via the deployed backdoors.

Impact

Victims of this compromise face a total takeover of their WordPress websites. The malware enables the exfiltration of sensitive site data, including credentials and API keys, and establishes deep persistence that survives typical plugin removal. Impacted users must perform a full site restoration from a clean backup to ensure the removal of attacker-controlled backdoors, cron jobs, and unauthorized administrative users.

Recommendation

1. Immediately verify the version of the Rank Math PRO plugin and update to version 3.0.124 or later if running 3.0.123.
2. Block outbound traffic to the known attacker domain 'rank1cdn.com' at the network perimeter.
3. Conduct a forensic review of the web server for unauthorized PHP files, modifications to .htaccess files, and unrecognized scheduled cron jobs.
4. Audit the WordPress administrative user list for unauthorized accounts created during or after the compromise window.
5. Force a password reset for all administrative users and rotate all API keys and secrets stored within the WordPress environment.
6. Restore the entire website from a known-clean backup created prior to October 15, 2026, as manual cleanup may be incomplete.