Hackers planted backdoors in official Rank Math PRO downloads

First reported by SecurityWeek at · Updated · 3 sources

Malicious copies of the paid WordPress plugin reached users through the vendor's website and updates between October 15 and October 16. According to The Hacker News, Rank Math said sites that installed and activated affected copies should be treated as compromised, with the distribution window running from 20:02 UTC to 07:12 UTC.

  • SecurityWeek identified the affected packages as version 3.0.123.

Covered by 3 publishers within 6 hours of the first report.

Reporting3

SecurityWeek Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack · Ionut Arghire
The Hacker News Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor · info@thehackernews.com (The Hacker News)
BleepingComputer WordPress SEO plugin Rank Math compromised to backdoor websites · Bill Toulas