On October 19, BleepingComputer and SecurityWeek both reported that Rank Math, one of the most widely used SEO plugins on WordPress, shipped malware out of its own official download. Anyone who downloaded Rank Math PRO 3.0.123 between October 15 at 20:02 UTC and October 16 at 07:12 UTC got files carrying a backdoor. Rank Math confirmed it in its security advisory.
Eleven hours. Rank Math pulled the files and shipped a clean build, 3.0.124.
The weekend reaction: check your version, hit update, move on. That reaction is wrong, and Rank Math's own advisory explains why.
TL;DR
- Only Rank Math PRO was affected. The free version, active on more than 4 million sites per WordPress.org, was not.
- Installing 3.0.124 over an infected site does not clean it. Rank Math says the malware recreates its backdoor on site visits.
- Rank Math tells affected sites to assume every secret on the site is exposed: database credentials, API and payment keys, SMTP and hosting logins.
- The bad file came from the official vendor download. "Only install from official sources" protected nobody.
Why "Just Update the Plugin" Makes It Worse
Rank Math's advisory is specific. If 3.0.123 was installed in that window, treat the site as compromised. Deleting the plugin folder is required. Deactivating the plugin alone is not sufficient.
The reason is the rebuild. Per Rank Math, the malware can recreate its hidden backdoor whenever someone visits the site. So order beats speed: delete the entire rank-math-pro folder, delete the malicious wp_options entries, block outbound traffic to rank1cdn.com, then look for what else changed. Only after cleanup does the advisory have you install 3.0.124.
Hit update first and you get a clean plugin on a dirty server. The version reads 3.0.124, the backdoor is still there, and you have stopped looking. That is the danger here. Not the malware. The false all-clear.
What the Rank Math PRO 3.0.123 Malware Actually Does
Per Rank Math and SecurityWeek, this is not a defacement or a spam injection. It is infrastructure. It writes entries into wp_options and talks to rank1cdn.com. It can create rogue administrator accounts, drop a fake core file at wp-includes/class-wp-cache-util.php, rewrite .htaccess so .cache files execute as PHP, and add cron jobs. Rank Math also warns about changes outside WordPress entirely, including SSH authorized keys and system crontabs.
That is not someone vandalizing your blog. That is someone taking a key to the building and making copies.
The Security Rule That Just Broke in Public
Every piece of WordPress security advice ever written contains the same line: only install plugins from official sources.
That line did not help. The files came from Rank Math's own servers, to paying PRO customers. The customers who followed best practice got hit. Free-version users were fine.
Rank Math has not said how it was breached, and BleepingComputer's question about the attack vector went unanswered at publication. That silence is not the real problem, because the problem underneath is not Rank Math's alone. Every plugin runs as PHP with your site's permissions and read access to wp-config.php. No sandbox.
So grade plugins on count, not reputation. Thirty plugins means thirty vendors whose build servers are part of your infrastructure. Most sites we audit carry eight to fifteen doing work a theme function could handle. Doors you are not even using.
Your Website Was Never the Target
Rank Math's advisory tells affected owners to assume any secrets on the site are exposed. For the companies we work with that is not abstract. That is the payment gateway key, the SMTP credentials, the CRM token.
BleepingComputer found a PHP sample on VirusTotal sharing the advisory's indicators of compromise, one that steals AWS, Cloudflare, Google Cloud and Azure credentials plus SSH keys. It could not confirm the sample shipped inside the plugin, so treat that as unconfirmed. Either way, your rotation list is every credential the server could read.
Getting Hit Was Luck. Recovering Is Not.
Eleven hours is the whole exposure window. Whether your site is compromised comes down to whether somebody on your team happened to click update between Thursday afternoon and early Friday morning, Eastern time. You cannot manage that. What you can manage is the next question. Can you restore your site, files and database both, to a clean state from before October 15 at 20:02 UTC?
If yes, this is a ninety-minute job. Restore, scan, rotate credentials, install 3.0.124. Rank Math says to rotate credentials even if you restore from a backup. If no, you are doing manual forensics on a backdoor engineered to survive it, and Rank Math's advisory points you to your hosting provider or a security professional.
Nobody buys a better backup because of a blog post. Buy one because the alternative just got priced for you, in public, with a date on it. If you would rather not own that job, it is exactly what website maintenance is for.
What To Do This Week
- Check the window, not the version number. Find out whether Rank Math PRO 3.0.123 was installed on any of your sites between October 15 at 20:02 UTC and October 16 at 07:12 UTC. If it was, follow Rank Math's removal order: delete the rank-math-pro folder, delete the malicious wp_options entries, block rank1cdn.com, then hunt for what else changed.
- Test a restore, not a backup. Take your highest-revenue site, restore it into staging from a backup dated before October 15, and time it. If you cannot finish, you do not have a backup, you have a file.
- Delete every plugin you are not using, then inventory the keys. Site by site, remove the dormant ones, then list which remaining plugins hold live API credentials and put those on rotation.
FAQ
I use the free version of Rank Math. Am I affected?
No. Rank Math states the issue affects PRO users only, and the free plugin on WordPress.org was not affected. Only PRO 3.0.123 downloaded in the October 15 to 16 window carried malicious files.
I updated to 3.0.124. Is my site clean now?
Not necessarily. Rank Math's advisory says deactivating is not sufficient, because the malware can recreate its backdoor on site visits, and it puts cleanup before installing 3.0.124. If 3.0.123 was installed in the window, you still have to delete the plugin folder, remove the malicious database entries, and rotate credentials.
How do I tell whether my site was actually breached?
Work the indicators in Rank Math's advisory: administrator accounts nobody created, a file at wp-includes/class-wp-cache-util.php, .htaccess rules executing .cache files as PHP, unknown SSH keys, and outbound connections to rank1cdn.com. Run a security scan and verify core and plugin checksums, as the advisory recommends. If deleted files reappear, the backdoor is live.
Should we switch off Rank Math entirely?
Probably not. Migrating SEO plugins means rebuilding metadata, schema and redirects: weeks of ranking risk for a vendor with the same exposure. If rankings are the worry rather than security, start with what Google's spam updates actually punish.
Nothing Is Trusted. Everything Is Recoverable.
The security industry taught everyone to sort software into trusted and untrusted. Official download, trusted. Nulled plugin off a forum, untrusted. That model just failed in public, on a mainstream product, to the customers who paid for it.
The replacement is less comforting and more useful: nothing is trusted, everything is recoverable. You cannot stop a vendor from having a bad night. You only decide what it costs you, in advance.
Book a 30-minute website risk review. No pitch, just a read on how long your site would take to restore and which plugins are holding your keys. Get a free strategy call.