Malware Found in Rank Math PRO WordPress Plugin
A compromised version of the Rank Math PRO SEO plugin distributed over 11 hours introduced a self-restoring backdoor. Sites using affected versions should be considered breached.
TL;DR
- Rank Math PRO plugin versions distributed between Oct 15 20:02 UTC and Oct 16 07:12 UTC contain malware.
- The backdoor is self-restoring, making manual removal difficult.
- Over 100,000 websites use Rank Math plugins, though exact impacted count is unknown.
- Users must treat affected sites as compromised and follow remediation steps.
- Rank Math has released clean versions and advises immediate update.
Between October 15 and October 16, 2026, malicious code was embedded into the Rank Math PRO WordPress plugin. The SEO tool, which powers over 100,000 websites, unknowingly served a compromised version that installs a persistent backdoor upon activation.
The breach window lasted just over 11 hours, but due to the plugin's widespread adoption, the potential impact is significant. Security researchers warn that the embedded backdoor can reinstall itself even after attempted removal, requiring thorough cleanup procedures.
Attack Details
- The malicious plugin versions were distributed directly from rankmath.com and through automatic updates.
- The infection window was from 20:02 UTC on October 15 to 07:12 UTC on October 16.
- Once activated, the plugin creates hidden admin users and installs a stealthy backdoor.
- The malware includes anti-detection features and attempts to disable security plugins.
- A self-restoration mechanism allows the backdoor to persist even after partial cleanup.
Response and Remediation
- Rank Math confirmed the breach and immediately pulled the infected versions.
- Clean plugin versions have been re-released for both free and PRO users.
- Affected sites should be treated as fully compromised regardless of visible symptoms.
- Site owners must remove all files associated with the malicious plugin versions.
- Full server audits, credential resets, and security hardening are strongly recommended.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.