/
← Voltar ao feed
high

Rank Math PRO 3.0.123 Plugin Compromised to Deliver Persistent Backdoor and Enable Credential Theft on WordPress Sites

1 fonte(s) · 1 atualização(ões) · publicado 20/10/2026 07:48 · coletado há 17 horas

Rank Math reported a security incident in which its premium Rank Math PRO WordPress plugin, version 3.0.123, was distributed with malware. Sites are at risk if administrators activated the compromised version. The affected download window ran from October 15, 2023 20:02 UTC to October 16, 2023 07:12 UTC (dates as stated in the article), and a limited number of users are affected. The free Rank Math SEO plugin on WordPress.org is not affected. Rank Math removed the malicious files and released clean version 3.0.124. The advisory does not name the attacker, explain how the distribution files were compromised, or quantify affected installations.

Technical Details

  • The malware recreates a hidden backdoor whenever someone visits an infected site, so disabling the plugin or deleting individual files does not remove the compromise.
  • Malicious entries exist in the WordPress options table under option_name values _uf6qdn2hmm, t8krdk990phb and _np5pvf754c.
  • Suspicious PHP files may be found in must-use plugins, other plugin directories, non-default theme folders and Rank Math's includes directory. Code indicators include base64_decode combined with XOR loops, the key xmmqhn, proc_open and PHP-FPM socket code.
  • Other artifacts: unauthorized administrator accounts starting with wpsupport_, email addresses ending in @wp-mail[.]net, the fake core file wp-includes/class-wp-cache-util.php, .htaccess rules enabling PHP execution in .cache files, and system cron entries tagged #ms6v46.
  • Outbound communication to rank1cdn[.]com is flagged for blocking.
  • Rank Math advises assuming that sensitive information accessible to the compromised site may have been exposed, although credential theft is not confirmed for every installation.

Remediation

  • Preferred: restore files and database from a clean backup made before October 15, 2023 20:02 UTC, then scan, rotate credentials and install version 3.0.124.
  • Without a clean backup: delete the entire rank-math-pro directory, remove the malicious options entries and the other persistence mechanisms, then investigate further changes.
  • Block outbound connections to rank1cdn[.]com where possible.
  • Rotate WordPress passwords, database credentials, security keys and salts, API tokens, payment gateway keys, SMTP credentials, hosting, FTP/SFTP and SSH credentials, and secrets in environment variables. Review and reset two-factor authentication settings if needed.
  • After cleanup, run wp core verify-checksums and wp plugin verify-checksums --all, scan with reputable tools, and monitor outbound traffic and deleted files for recurrence. Premium plugins may lack public checksums, so compare against clean official packages.
  • Users who installed but did not activate 3.0.123 should delete it, install the clean release and scan.

Linha do tempo

  1. gbhackers.com ↗ · pub. 20/10/2026 07:48 · coletado 20/10 09:00 primeiro registro

    Rank Math PRO 3.0.123 Plugin Compromised to Deliver Persistent Backdoor and Enable Credential Theft on WordPress Sites

    ler a análise desta fonte

    Rank Math reported a security incident in which its premium Rank Math PRO WordPress plugin, version 3.0.123, was distributed with malware. Sites are at risk if administrators activated the compromised version. The affected download window ran from October 15, 2023 20:02 UTC to October 16, 2023 07:12 UTC (dates as stated in the article), and a limited number of users are affected. The free Rank Math SEO plugin on WordPress.org is not affected. Rank Math removed the malicious files and released clean version 3.0.124. The advisory does not name the attacker, explain how the distribution files were compromised, or quantify affected installations.

    Technical Details

    • The malware recreates a hidden backdoor whenever someone visits an infected site, so disabling the plugin or deleting individual files does not remove the compromise.
    • Malicious entries exist in the WordPress options table under option_name values _uf6qdn2hmm, t8krdk990phb and _np5pvf754c.
    • Suspicious PHP files may be found in must-use plugins, other plugin directories, non-default theme folders and Rank Math's includes directory. Code indicators include base64_decode combined with XOR loops, the key xmmqhn, proc_open and PHP-FPM socket code.
    • Other artifacts: unauthorized administrator accounts starting with wpsupport_, email addresses ending in @wp-mail[.]net, the fake core file wp-includes/class-wp-cache-util.php, .htaccess rules enabling PHP execution in .cache files, and system cron entries tagged #ms6v46.
    • Outbound communication to rank1cdn[.]com is flagged for blocking.
    • Rank Math advises assuming that sensitive information accessible to the compromised site may have been exposed, although credential theft is not confirmed for every installation.

    Remediation

    • Preferred: restore files and database from a clean backup made before October 15, 2023 20:02 UTC, then scan, rotate credentials and install version 3.0.124.
    • Without a clean backup: delete the entire rank-math-pro directory, remove the malicious options entries and the other persistence mechanisms, then investigate further changes.
    • Block outbound connections to rank1cdn[.]com where possible.
    • Rotate WordPress passwords, database credentials, security keys and salts, API tokens, payment gateway keys, SMTP credentials, hosting, FTP/SFTP and SSH credentials, and secrets in environment variables. Review and reset two-factor authentication settings if needed.
    • After cleanup, run wp core verify-checksums and wp plugin verify-checksums --all, scan with reputable tools, and monitor outbound traffic and deleted files for recurrence. Premium plugins may lack public checksums, so compare against clean official packages.
    • Users who installed but did not activate 3.0.123 should delete it, install the clean release and scan.