Rank Math PRO downloads backdoored in WordPress supply-chain compromise

On 16 October 2026, Rank Math — the India-based maker of a WordPress SEO plugin whose free edition is active on more than 4 million websites — confirmed that attackers had tampered with downloads of its paid Rank Math PRO plugin, version 3.0.123, on the company's official website. Copies obtained during an 11-hour window, from 20:02 UTC on 15 October to 07:12 UTC on 16 October, contained malware that planted hidden backdoors once the plugin was activated. Only the PRO build distributed from the vendor's site was affected; the free version hosted on WordPress.org was not.

Rank Math characterised the impact as reaching several hundred customers and said the initial attack vector had not been determined. The company removed the affected files, published a security advisory, and released a clean build, Rank Math PRO v3.0.124; Wordfence issued its own advisory alerting site owners.

What the backdoor does

According to Rank Math, the implanted code establishes persistent access, communicates with the domain rank1cdn[.]com, and recreates hidden backdoors whenever someone visits an infected site — exposing database credentials, API keys, and other secrets accessible to the web server. Researchers reported indicators including outbound connections to that domain and unexpected administrator accounts with names beginning wpsupport_. Crucially, simply updating or deactivating the plugin does not remove the threat: the vendor and Wordfence advised that any site which activated v3.0.123 during the window be treated as compromised, with files and databases restored from a clean pre-incident backup, the plugin folder deleted, and all passwords, keys, and salts rotated.

Why it matters

Supply-chain compromises of popular WordPress extensions turn a single vendor breach into a mass-exploitation event, since the malicious code arrives through the trusted update-and-download channel that site owners are told to rely on. With a self-healing backdoor and the ability to harvest cloud and server secrets, the Rank Math incident gave attackers a potential foothold on every site that installed the tainted build — a reminder that the plugins extending a CMS are as much part of its attack surface as the core software.