Rank Math Pro Backdoor Found in Official Plugin Downloads

You download a plugin from the vendor’s own website, install it, and activate it. That is about as safe as WordPress gets. Now imagine that the plugin file itself carried a backdoor, and within minutes of activation your website is quietly handing over database credentials, API keys, and cloud secrets to an attacker.

That is exactly what happened to a limited number of Rank Math PRO users last week. Malicious files sat on the official Rank Math download server for about 11 hours, and anyone who installed and activated version 3.0.123 in that window should treat their website as compromised. Here is what we know, how to check if you are affected, and how to clean up.

What Happened in the Rank Math Pro Supply-Chain Attack

Rank Math confirmed that some downloads of Rank Math PRO from its official website carried malware. The affected version was Rank Math PRO 3.0.123, and the poisoned files were available for download between October 15 at 20:02 UTC and October 16 at 07:12 UTC.

Key facts from the vendor’s advisory:

• Only the paid Rank Math PRO version was compromised. The free Rank Math SEO plugin from WordPress.org, active on more than 4 million websites, was not affected.
• The malware triggers on activation. If you downloaded the file but never activated it, deleting it removes the risk.
• Rank Math removed the affected files and released a clean version, Rank Math PRO 3.0.124.
• Users who installed and activated the trojanized 3.0.123 should assume the website is compromised and follow a full clean-up.

The attack window was short, but SEO plugins run on high-traffic sites with access to everything WordPress can reach. For an attacker, 11 hours of clean-looking downloads from a trusted domain is plenty.

What the Malware Does to an Infected Website

According to Rank Math, the malicious plugin files establish persistent access and communicate with the command-and-server domain rank1cdn[.]com. The nastiest part is that the backdoor recreates itself. Every time someone visits the infected website, hidden backdoors are planted again, which is why simply updating the plugin does not clean the site.

Research from BleepingComputer found a related PHP sample on VirusTotal, a first-stage deployment script with the same indicators of compromise listed in the Rank Math alert:

• An XOR obfuscation key using the string xmmqhn.
• A hidden WordPress database entry named _np5pvf754c.
• A scheduled task marked with the #ms6v46 cron job marker.
• Code that creates rogue administrator accounts with usernames starting with wpsupport_ and @wp-mail.net email addresses.
• A backdoor file dropped at wp-includes/class-wp-cache-util.php.

The script can execute commands on the server, modify the WordPress database, and steal credentials well beyond WordPress itself. AWS keys, Cloudflare tokens, Google Cloud and Azure credentials, and SSH keys are all in scope. On a shared hosting account, that can expose every site on the account, not just the infected one.

How to Tell If Your Site Is Affected

Work through this checklist before you touch anything else.

1. Confirm your version and timing. Check whether you downloaded Rank Math PRO 3.0.123 between October 15 at 20:02 UTC and October 16 at 07:12 UTC. If you installed any other version, or installed outside that window, you are very likely not affected.
2. Check for the hidden database entry. Search the wp_options table for _np5pvf754c. If it exists, the site is infected.
3. Check scheduled tasks. Look for cron jobs containing the #ms6v46 marker.
4. List administrator accounts. Any account with a wpsupport_ prefix or an @wp-mail.net email address is attacker-created.
5. Look for the backdoor file. A file named class-wp-cache-util.php inside wp-includes is malicious. The real WordPress core does not use that filename.
6. Review outbound traffic. Firewall or host logs showing connections to rank1cdn[.]com confirm the compromise.

How to Clean an Infected WordPress Site

Rank Math is blunt about this: deactivating or updating the plugin after a compromise does not remove the threat. The backdoor recreates itself on page visits. Follow this order.

1. Restore from a clean backup. If you have a backup of the files and database from before October 15, restore both. This is the fastest and most reliable route.
2. No safe backup? Clean manually. Delete the entire Rank Math plugin folder. Remove the _np5pvf754c database entry. Then hunt for the rest: rogue admin accounts, modified core files, unfamiliar scheduled tasks, and changes outside WordPress such as altered .htaccess rules or new files in system folders.
3. Install the clean version. Download Rank Math PRO 3.0.124 or later from the official site only after the clean-up is done.
4. Rotate everything. Change all passwords, API keys, and salts. That includes WordPress admin and database passwords, hosting panel logins, FTP or SSH accounts, cloud credentials, and any licence keys stored on the server.
5. Block the C2 domain. Add a firewall rule or hosts entry that blocks outbound connections to rank1cdn[.]com. If a leftover backdoor calls home and gets no answer, it does far less damage.
6. Scan again after 24 hours. Because the backdoor recreates itself on visits, rescan after cleaning to confirm nothing returned.

What We Still Do Not Know

Some questions remain open. Rank Math has not said how many sites downloaded the trojanized 3.0.123 files, or how the attackers got the malware onto the official download server in the first place. BleepingComputer reached out to Rank Math for details on the affected site count and the initial attack vector but had received no response by publication.

Wordfence published its own advisory covering the malware, and BleepingComputer could not confirm whether the first-stage PHP sample it found on VirusTotal was distributed through the compromised plugin or spread separately. Treat both advisories as your checklist. When the facts are incomplete, indicators of compromise are what you rely on.

Tips: How to Reduce Plugin Supply-Chain Risk

• Update plugins a few days after release, not the hour they appear. Supply-chain windows like this one are usually short, and waiting is free protection.
• Keep a verified offsite backup, and test restoring it twice a year. A backup you have never restored is a hope, not a plan.
• Use a file integrity monitor. WordPress core files and plugin folders should not change without an update. Wordfence, Sucuri, and similar scanners flag new files like class-wp-cache-util.php quickly.
• Restrict file write access. On hardened setups, the web server cannot write to plugin folders, so a dropped backdoor is inert.
• Watch outbound traffic. Most WordPress malware has to call home. A DNS or firewall log that records outbound domains is often the fastest detection you can get.

FAQ

Is the free Rank Math SEO plugin safe?

Yes. Rank Math says only the PRO version was affected, and the free plugin distributed through WordPress.org was never compromised. If you run the free version, no action is needed beyond normal updates.

Does updating to Rank Math Pro 3.0.124 fix an infected site?

No. Updating replaces the plugin files but the malware leaves hidden backdoors, database entries, and rogue admin accounts behind. Clean the site first using the vendor advisory, then install the clean version.

I downloaded 3.0.123 but never activated it. Am I at risk?

The malware runs on activation. If the plugin was never activated, delete the downloaded file and install 3.0.124 instead. Running a scan afterwards is still a sensible check.

How do I know if my WordPress site has a backdoor?

Look for the signs listed in the article: the _np5pvf754c database entry, the #ms6v46 cron marker, wpsupport_ admin accounts, and the class-wp-cache-util.php file in wp-includes. A file integrity scanner confirms it in minutes.