ThreatRoundup
High

Rank Math PRO Shipped a Backdoor for 11 Hours

Rank Math PRO 3.0.123, served from the vendor's own site for about 11 hours on Oct. 15-16, carried a backdoor that creates hidden admins and rebuilds itself. Updating alone doesn't clean it.

ThreatRoundup · · 2 min read

Someone slipped a backdoor into an official Rank Math PRO release. According to BleepingComputer, version 3.0.123 of the paid WordPress SEO plugin was served from the vendor’s own website with trojanized files for about 11 hours, from 20:02 UTC on Oct. 15 to 07:12 UTC on Oct. 16. Rank Math’s incident notice says the free plugin on WordPress.org was not affected, and a clean 3.0.124 is out. Neither the vendor nor BleepingComputer has said how the attacker got into the release pipeline.

For defenders

Affected: Rank Math PRO 3.0.123 downloaded from rankmath.com inside the window above. Fixed: 3.0.124. CVE/CVSS: none; this is a supply-chain compromise, not a coding bug. Rank Math calls the number of affected users “limited” and has not given a count.

Per Rank Math and BleepingComputer, the payload fires on plugin activation, phones home to an attacker domain, plants a fake core file and hidden admin accounts, adds cron jobs, adds .htaccess rules that let .cache files run as PHP, and re-creates its backdoors on page loads. BleepingComputer says it exposes database credentials, API keys and other secrets the web server can read. It also found a related PHP sample on VirusTotal that steals AWS, Cloudflare, Google Cloud and Azure credentials plus SSH keys, but it could not confirm that sample shipped through the plugin. ATT&CK: T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain), T1505.003 (Server Software Component: Web Shell), T1136 (Create Account), T1053.003 (Scheduled Task/Job: Cron).

Network
rank1cdn[.]com
Rogue admin emails ending @wp-mail[.]net

Host
wp-includes/class-wp-cache-util.php (fake core file)
Admin usernames starting wpsupport_
wp_options option_name: _uf6qdn2hmm, t8krdk990phb, _np5pvf754c
Cron marker: #ms6v46
XOR key in obfuscated PHP: xmmqhn
.htaccess rules executing .cache files as PHP

Related sample (unconfirmed link)
SHA-256 f99a42f622e9a638f1b27dc051a48619a5a2d7f3432a4480fecf1413253629c9

What it means for you

If your website runs WordPress and you pay for Rank Math PRO, check which version you have. If it’s 3.0.123 and you turned it on, assume a stranger has had admin-level access to your site, and possibly to the passwords and keys stored on it. Rank Math says updating or switching the plugin off does not remove the malware, because it rebuilds itself when visitors load your pages. If you use the free Rank Math plugin, or no Rank Math at all, this one doesn’t touch you.

Do this now

  1. Confirm your Rank Math PRO version on every site you manage. If 3.0.123 was ever activated, treat the site as compromised.
  2. Best option: restore files and database from a backup taken before 20:02 UTC on Oct. 15, then install 3.0.124 from your rankmath.com account. With no clean backup, delete the whole rank-math-pro folder and the three wp_options entries first, then hunt for the other artifacts above, following Rank Math’s cleanup steps.
  3. Rotate everything the server could read: WordPress and database passwords, salts, API and SMTP keys, hosting, FTP and SSH credentials, and any cloud keys on the box.
  4. Block outbound traffic to rank1cdn[.]com and watch for removed files coming back over the next several days.

More from the Roundup