Rank Math says some copies of its paid WordPress SEO plugin, Rank Math PRO, were compromised with malware that creates hidden backdoors on affected websites. Multiple outlets report the malicious packages were delivered between about 20:02 UTC on October 15 and 07:12 UTC on October 16, affecting installations and activations that used those tampered files.
The incident is described as a supply-chain attack. According to the reports, the malware was injected into Rank Math PRO version 3.0.123 distributed through the vendor’s channels, including downloads from rankmath.com and plugin updates delivered during the affected window. The Hacker News adds that the backdoor is self-restoring, while other coverage focuses on the supply-chain nature of the compromise and the need to treat any site that installed those packages as potentially compromised.
While outlets agree on the distribution window, impacted version/package, and that backdoors were planted, they differ slightly in emphasis—some highlight the mechanism (self-restoring behavior), while others stress the broader supply-chain vector and affected distribution methods. Rank Math’s public security notice directs users toward remediation and incident handling for installations from the relevant period.
