Rank Math SEO PRO, used on 4 million+ sites, shipped malware for 11 hours
A supply-chain compromise put backdoored files into Rank Math PRO downloads for about eleven hours on 15 and 16 October. Updating alone will not clean an infected site.
Rank Math says copies of Rank Math SEO PRO version 3.0.123 downloaded or updated between 15 October at 20:02 UTC and 16 October at 07:12 UTC contained injected malware. Rank Math SEO, the free base plugin, says it has over 4 million users; PRO is the paid add-on that sits on top of it.
The malware creates hidden backdoors that rebuild themselves on page visits, plants encoded entries in the WordPress options table, drops obfuscated PHP files, can create a rogue admin account, and phones home to rank1cdn.com. Rank Math pulled the affected files and shipped a clean 3.0.124, but says updating is not enough: sites that ran the bad build should be treated as compromised, restored from a backup taken before the window, or manually cleaned, deleting the malicious database entries and backdoor files, rotating every credential and API key, and blocking the callback domain.
Why it matters: this is not a bug waiting to be exploited, it is malware that already ran on live sites during an eleven-hour window. If you or a client runs Rank Math PRO and updated in that window, patching to 3.0.124 does not undo whatever the backdoor already did.
The caveat: Rank Math has not said how many sites actually pulled the bad build during the window, only that anyone who did should assume compromise.