/
← Voltar ao feed
high

Rank Math PRO 3.0.123 trojanized in supply-chain attack, planting hidden backdoors on WordPress sites

1 fonte(s) · 1 atualização(ões) · publicado 19/10/2026 18:24 · coletado há 1 dia

A supply-chain attack compromised Rank Math PRO (WordPress SEO plugin) version 3.0.123, downloaded from the vendor's official website between October 15 20:02 UTC and October 16 07:12 UTC. The trojanized package planted persistent, self-recreating hidden backdoors on sites where it was activated, and exposed database credentials, API keys and other secrets accessible to the web server. The free Rank Math SEO from WordPress.org was not affected. The vendor released clean version 3.0.124 and has not disclosed the number of affected sites or the initial attack vector. BleepingComputer also found a related PHP sample on VirusTotal, but could not confirm it was distributed via the compromised plugin.

Technical Details

  • The malware communicates with rank1cdn[.]com, establishes persistence and recreates hidden backdoors when the infected site is visited.
  • Backdoor file referenced by the vendor: wp-includes/class-wp-cache-util.php.
  • IoCs: XOR obfuscation key xmmqhn, database entry _np5pvf754c, cron job marker #ms6v46, and creation of administrator accounts with the wpsupport_ username prefix and @wp-mail.net email addresses.
  • VirusTotal sample cache-preloader-fff033 (1).php shares these IoCs and appears to be a first-stage deployment script. It can execute commands, modify WordPress databases, and steal AWS, Cloudflare, Google Cloud and Azure credentials, SSH keys and other sensitive data. Its link to the compromised plugin is unconfirmed.

Remediation

  • Treat any site that installed and activated 3.0.123 as compromised.
  • Restore files and database from a clean backup, run security scans, and rotate all passwords, keys and salts.
  • Without a clean backup, clean up manually: delete the entire plugin folder and malicious database entries, then hunt for additional backdoors, unauthorized administrator accounts, altered files, scheduled tasks and changes outside WordPress. Deactivating or updating the plugin does not remove the threat.
  • Block outbound connections to rank1cdn[.]com.
  • If the plugin was installed but never activated, delete it, download clean 3.0.124 and scan the site.

Linha do tempo

  1. bleepingcomputer.com ↗ · pub. 19/10/2026 18:24 · coletado 19/10 19:00 primeiro registro

    Rank Math PRO 3.0.123 trojanized in supply-chain attack, planting hidden backdoors on WordPress sites

    ler a análise desta fonte

    A supply-chain attack compromised Rank Math PRO (WordPress SEO plugin) version 3.0.123, downloaded from the vendor's official website between October 15 20:02 UTC and October 16 07:12 UTC. The trojanized package planted persistent, self-recreating hidden backdoors on sites where it was activated, and exposed database credentials, API keys and other secrets accessible to the web server. The free Rank Math SEO from WordPress.org was not affected. The vendor released clean version 3.0.124 and has not disclosed the number of affected sites or the initial attack vector. BleepingComputer also found a related PHP sample on VirusTotal, but could not confirm it was distributed via the compromised plugin.

    Technical Details

    • The malware communicates with rank1cdn[.]com, establishes persistence and recreates hidden backdoors when the infected site is visited.
    • Backdoor file referenced by the vendor: wp-includes/class-wp-cache-util.php.
    • IoCs: XOR obfuscation key xmmqhn, database entry _np5pvf754c, cron job marker #ms6v46, and creation of administrator accounts with the wpsupport_ username prefix and @wp-mail.net email addresses.
    • VirusTotal sample cache-preloader-fff033 (1).php shares these IoCs and appears to be a first-stage deployment script. It can execute commands, modify WordPress databases, and steal AWS, Cloudflare, Google Cloud and Azure credentials, SSH keys and other sensitive data. Its link to the compromised plugin is unconfirmed.

    Remediation

    • Treat any site that installed and activated 3.0.123 as compromised.
    • Restore files and database from a clean backup, run security scans, and rotate all passwords, keys and salts.
    • Without a clean backup, clean up manually: delete the entire plugin folder and malicious database entries, then hunt for additional backdoors, unauthorized administrator accounts, altered files, scheduled tasks and changes outside WordPress. Deactivating or updating the plugin does not remove the threat.
    • Block outbound connections to rank1cdn[.]com.
    • If the plugin was installed but never activated, delete it, download clean 3.0.124 and scan the site.