Full Report
Some downloads of the Rank Math PRO WordPress plugin from the vendor's official website carried malware that planted hidden backdoors in a supply-chain attack last week. [...]
Analysis Summary
# Incident Report: Rank Math PRO Supply-Chain Compromise Distributing WordPress Backdoors
## Executive Summary
Between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC, some downloads of Rank Math PRO version 3.0.123 from the vendor's official website contained malware. Sites that installed and activated the trojanized plugin during this window may have had hidden backdoors planted, along with exposed database credentials, API keys, and other secrets. The vendor removed the affected files and released clean version 3.0.124. The number of affected sites has not been disclosed.
## Incident Details
- **Discovery Date:** Not precisely stated. The vendor published its advisory after detecting the issue. BleepingComputer's related analysis was published October 19, 2026.
- **Incident Date:** October 15, 2026, 20:02 UTC to October 16, 2026, 07:12 UTC (approximately 11 hours)
- **Affected Organization:** Rank Math (vendor of the WordPress SEO plugin). Affected parties are customers who downloaded the PRO plugin during the window. The number is undisclosed.
- **Sector:** Software / WordPress ecosystem (SEO tooling)
- **Geography:** Not disclosed. The vendor's download distribution was global.
## Timeline of Events
### Initial Access
- **Date/Time:** October 15, 2026, 20:02 UTC (start of the compromised download window)
- **Vector:** Supply-chain compromise of the vendor's official download distribution for Rank Math PRO. The vendor has not confirmed how attackers gained access to its infrastructure.
- **Details:** Users who downloaded version 3.0.123 during the window received trojanized plugin files. The malware executed when the plugin was activated. The free version on WordPress.org was not affected.
### Lateral Movement
- Not applicable in the traditional network sense. Within compromised WordPress sites, the malware deploys a backdoor (`wp-includes/class-wp-cache-util.php`) and creates unauthorized administrator accounts. The threat is described as capable of modifying WordPress databases and executing commands.
### Data Exfiltration/Impact
- **Exposed data:** Database credentials, API keys, and other secrets accessible to the web server.
- **Potential theft:** Per analysis of a related PHP sample, the malware can steal AWS, Cloudflare, Google Cloud, and Azure credentials, as well as SSH keys and other sensitive information.
- **Command channel:** The malware communicates with the attacker domain `rank1cdn[.]com`.
### Detection & Response
- **Detection:** The vendor identified and disclosed the incident. BleepingComputer independently found a related PHP malware sample on VirusTotal that shared the same indicators of compromise (IoCs). That sample was not mentioned in the vendor or Wordfence advisories.
- **Response:**
- The vendor removed the affected files.
- The vendor released clean version Rank Math PRO 3.0.124.
- The vendor published a security advisory with cleanup guidance.
- Wordfence published its own analysis.
- BleepingComputer contacted the vendor for the number of affected sites and the initial attack vector. No response was received by publication.
## Attack Methodology
- **Initial Access:** Trojanized plugin package (version 3.0.123) distributed through the vendor's official website. The upstream compromise method is undisclosed.
- **Persistence:** Malware re-creates hidden backdoors when the infected website is visited. A cron job with marker `#ms6v46` provides scheduled execution. Unauthorized administrator accounts use the `wpsupport_` username prefix and `@wp-mail[.]net` email addresses.
- **Privilege Escalation:** Creation of administrator accounts gives full WordPress control. Access to web server secrets may enable further escalation.
- **Defense Evasion:** XOR obfuscation (key `xmmqhn`). Malicious files are disguised with names such as `_cache-preloader-fff033 (1).php` and `class-wp-cache-util.php`. Malware is triggered only on activation or site visits, which may delay detection.
- **Credential Access:** Harvesting of database credentials, API keys, and secrets accessible to the web server. The related sample also targets AWS, Cloudflare, Google Cloud, and Azure credentials and SSH keys.
- **Discovery:** Not publicly documented.
- **Lateral Movement:** Stolen cloud and SSH credentials could enable movement beyond the WordPress site. Not confirmed in reporting.
- **Collection:** Harvesting of secrets and configuration data from the web server and WordPress database.
- **Exfiltration:** Communication with C2 domain `rank1cdn[.]com`. Specific exfiltration volumes are not reported.
- **Impact:** Persistent unauthorized access, database manipulation, possible command execution, and exposure of cloud and infrastructure credentials.
## Impact Assessment
- **Financial:** Not disclosed.
- **Data Breach:** Potential exposure of database credentials, API keys, cloud credentials (AWS, Cloudflare, Google Cloud, Azure), and SSH keys on affected sites. The number of affected sites is unknown.
- **Operational:** Affected websites require full cleanup, credential rotation, and possibly restoration from clean backups. Deactivating or updating the plugin alone does not remove the threat.
- **Reputational:** Damage to trust in the vendor's distribution channel. Risk to a plugin installed on more than 4 million sites in its free variant, though only the PRO version was affected.
## Indicators of Compromise
**Network Indicators**
- C2 domain: `rank1cdn[.]com`
- Email domain pattern: `@wp-mail[.]net`
**File Indicators**
- Backdoor path: `wp-includes/class-wp-cache-util.php`
- Suspicious sample name: `_cache-preloader-fff033 (1).php`
- Related sample SHA-256: `f99a42f622e9a638f1b27dc051a48619a5a2d7f3432a4480fecf1413253629c9`
- Affected plugin: Rank Math PRO version 3.0.123 (clean version: 3.0.124)
**Behavioral and Other Indicators**
- XOR obfuscation key: `xmmqhn`
- WordPress database entry: `_np5pvf754c`
- Cron job marker: `#ms6v46`
- Unauthorized administrator accounts with the `wpsupport_` username prefix
- Backdoor recreation when infected sites are visited
## Response Actions
**Containment**
- Deactivate and remove Rank Math PRO 3.0.123.
- Block outbound connections to `rank1cdn[.]com`.
- Users who installed but never activated the plugin should delete it and scan their sites.
**Eradication**
- Restore website files and the database from a known-clean backup where available.
- Where no clean backup exists, follow the vendor's manual cleanup procedure: delete the entire plugin folder and malicious database entries first.
- Investigate and remove unauthorized administrator accounts, altered files, scheduled tasks (including the `#ms6v46` cron job), and any changes outside WordPress.
- Run malware scans (for example, Wordfence or equivalent).
**Recovery**
- Install clean Rank Math PRO 3.0.124.
- Rotate all passwords, API keys, database credentials, salts, SSH keys, and cloud credentials (AWS, Cloudflare, Google Cloud, Azure).
- Review logs for suspicious access and activity during and after the compromise window.
## Lessons Learned
- **Key takeaways:**
- Software distributed directly from a vendor website can be a supply-chain attack vector, even when the free version from the official repository is clean.
- Plugin activation alone can trigger compromise, so the risk begins at installation.
- Web servers often hold high-value secrets (cloud keys, SSH keys), so a single compromised plugin can expose far more than the website.
- Updating or deactivating a compromised plugin does not remove persistence mechanisms.
- **What could have been done better:**
- Verification of download integrity (checksums or signatures) would help users confirm package authenticity.
- Earlier public disclosure of affected versions and indicators would have helped site owners respond.
- Vendor transparency about the number of affected sites and the initial attack vector is still lacking.
- The related malware sample was not included in vendor or Wordfence advisories, showing gaps in IoC sharing.
## Recommendations
- **For site owners:**
- Verify plugin integrity against vendor-published hashes or signatures before installation.
- Use the WordPress.org repository or other trusted sources where possible.
- Restrict web server access to secrets. Use least-privilege IAM roles and avoid storing long-lived cloud or SSH keys on web servers.
- Monitor for unexpected administrator accounts, new cron jobs, and unexplained outbound connections.
- Maintain regularly tested, offline backups to enable clean restoration.
- **For vendors:**
- Enforce code signing for plugin releases and publish hashes alongside downloads.
- Protect build and release pipelines with strong access controls and integrity checks.
- Monitor released artifacts for tampering and provide rapid, transparent disclosure.
- Share complete IoCs with the security community and coordinate with researchers.
- **For the WordPress ecosystem:**
- Consider automated scanning of premium plugin distributions and detection of obfuscated payloads.
- Use egress filtering on web servers to limit command-and-control communication.