Hackers Compromise Rank Math PRO WordPress Plugin to Install Self-Rebuilding Backdoors

Hackers planted malware in copies of the Rank Math PRO WordPress plugin, exposing websites to hidden backdoors that can rebuild themselves after removal. Rank Math confirmed that some version 3.0.123 packages distributed during a limited October download window contained malicious code that could compromise websites when activated. The company removed the affected files and released clean version 3.0.124.

The affected window ran from October 15, 2026, at 20:02 UTC to October 16 at 07:12 UTC. Rank Math described the impact as limited but did not provide an affected website count in its security advisory. The free Rank Math SEO plugin available through WordPress.org is not affected, and its users need no action for this incident.

Website owners who installed and activated an affected package must treat their sites as compromised. Installing the clean release alone does not complete recovery because malicious files, database entries, accounts, or server changes may remain. Users who installed the package without activating it should delete it, install the clean version, and run a precautionary scan. Downloading it without installation or activation does not establish compromise.

Rank Math PRO Backdoor Survives Removal

Rank Math warns that the malware can recreate its hidden backdoor whenever someone visits an infected website. Deleting a suspicious PHP file may therefore provide only temporary relief while the components responsible for restoring it remain active. Deactivating the plugin is also insufficient, according to the vendor’s recovery guidance.

Manual cleanup must begin by deleting the entire rank-math-pro directory. Administrators must then remove malicious records from the WordPress options table before hunting for remaining backdoors.

Rank Math lists three suspicious option_name values, _uf6qdn2hmm, t8krdk990phb, and _np5pvf754c. Where supported, hosting providers or firewalls should also block outgoing connections to rank1cdn[.]com.

The vendor identifies several places where hidden PHP files may appear, including wp-content/mu-plugins/, other plugin folders, non-default theme directories, and Rank Math’s includes/ folder. Investigators should look for base64_decode combined with XOR loops, the key xmmqhn, proc_open, or PHP-FPM socket code. These are investigation clues that require review within the surrounding file.

Additional warning signs include unfamiliar administrator accounts with usernames beginning wpsupport_ or email addresses ending @wp-mail[.]net. Rank Math also identifies wp-includes/class-wp-cache-util.php as a fake core file. Its guidance calls for checking .htaccess rules that allow .cache files to execute as PHP and system cron entries tagged #ms6v46. These checks cover several possible routes back into a cleaned website.

The cleanup challenge resembles earlier self-healing WordPress malware covered by Cyber Security News, where surviving components restored deleted files.

Separately, a BdThemes supply chain attack showed how trusted plugin features could become a path to account takeover and persistent access. Neither comparison establishes a link between those attackers and this incident. Recovery Requires More Than a Plugin Update.

Rank Math recommends restoring both website files and the database from a clean backup made before October 15 at 20:02 UTC. Restoring only plugin files could leave malicious database content untouched. After restoration, owners should scan the site, replace exposed credentials, and install Rank Math PRO 3.0.124 from their account.

Without a suitable backup, owners need a wider investigation after disabling the rebuilding mechanism. That includes checking users, scheduled WordPress events, uploads, plugins, and themes.

The vendor also recommends reviewing SSH authorized_keys, running processes, other users’ crontabs, and writable locations outside the website directory. Shared hosting customers should ask their provider to examine areas they cannot access.

All secrets accessible to the compromised website should be treated as potentially exposed, even after a backup restore. Rank Math advises replacing WordPress passwords, database credentials, security keys and salts, payment gateway keys, SMTP credentials, API keys, and hosting access credentials. Administrator two-factor authentication settings also require review. This is precautionary guidance, not confirmation that every affected site suffered data theft.

Finally, owners should scan with tools such as Wordfence or Sucuri and run wp core verify-checksums. Premium plugins may lack public checksums, requiring comparison with official clean copies.

Monitor outgoing connections and returning files over subsequent days. Rank Math urges users to visit its website directly and warns that it will not email login or download links.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.

The post Hackers Compromise Rank Math PRO WordPress Plugin to Install Self-Rebuilding Backdoors appeared first on Cyber Security News.