Rank Math PRO WordPress Plugin Compromised to Spread Malware and Steal Credentials

Rank Math has reported a security incident involving malware distributed through Rank Math PRO version 3.0.123.

They warn that WordPress websites using this compromised plugin are at risk if administrators activated it. The company has removed the affected files and released a clean version, 3.0.124.

Rank Math PRO Compromised

The incident impacts a limited number of users who downloaded the premium plugin between October 15, 2023, at 20:02 UTC and October 16, 2023, at 07:12 UTC.

Rank Math confirmed that its free SEO plugin, available through WordPress.org, is unaffected, so those users need no action.

The advisory describes persistence mechanisms that complicate cleanup efforts. The malware can recreate a hidden backdoor whenever someone visits an infected website. As a result, simply disabling the plugin or deleting individual suspicious files does not fully resolve the compromise.

Administrators who are performing manual recovery must first delete the entire rank-math-pro directory and remove malicious entries from the WordPress options table.

The option_name values to be deleted are _uf6qdn2hmm, t8krdk990phb, and _np5pvf754c. Rank Math also recommends blocking outbound connections to rank1cdn[.]com where hosting or firewall controls allow it.

The advisory identifies suspicious PHP files in must-use plugins, other plugin directories, non-default theme folders, and Rank Math’s includes directory. Key code indicators to look for include base64_decode combined with XOR loops, the key xmmqhn, proc_open, and PHP-FPM socket code.

Additional investigation targets include unauthorized administrator accounts that start with wpsupport_, email addresses ending in @wp-mail[.]net, and the fake WordPress core file wp-includes/class-wp-cache-util.php.

Administrators should also review .htaccess rules that enable PHP execution in .cache files and inspect system cron entries tagged #ms6v46, as per the advisory.

Rank Math recommends that affected organizations assume that sensitive information accessible to the compromised website may have been exposed.

While this precaution does not confirm that every affected installation suffered credential theft, it emphasizes the need for comprehensive credential rotation.

The recovery guidance includes changing WordPress passwords, database credentials, security keys and salts, API tokens, payment gateway keys, SMTP credentials, hosting access, FTP/SFTP, SSH credentials, and secrets stored in environment variables. Administrators should also review and, if necessary, reset two-factor authentication settings.

The preferred recovery method is to restore website files and the database from a clean backup created before October 15, 2023, at 20:02 UTC.

After restoring, administrators should perform security scanning, replace credentials, and install version 3.0.124. Users without appropriate backups must remove persistence mechanisms before investigating any additional malicious changes.

After cleanup, administrators should run wp core verify-checksums and wp plugin verify-checksums –all, scan with reputable security tools, and monitor outbound traffic and deleted files for any recurrence. Premium plugins may lack public checksums, necessitating comparison against clean official packages.

The advisory does not identify the attacker, explain how the distribution files were compromised, or quantify the number of affected installations. Users who installed but did not activate the contaminated version should delete it, install the clean release, and run a scan, since downloading alone does not indicate a website compromise.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.