A major WordPress SEO plugin, Rank Math PRO, was found to contain malware after a supply‑chain attack. The malicious code was injected into version 3.0.123, released on 15 October, and distributed to users worldwide. Those who downloaded or updated to this version risk having their sites hijacked if the plugin was activated.
The breach was discovered by Rank Math’s security team, who noted that the affected packages carried hidden scripts capable of granting attackers remote control over a website. The attackers likely inserted the code during the build process, exploiting the distribution pipeline that delivers plugin updates to users. Rank Math issued a warning and urged all users to roll back to a clean version or update to the latest release once it was available.
Rank Math’s monitoring detected unusual activity in the update repository. The team performed a forensic audit of the code base and identified the malicious payload in the 3.0.123 build. They immediately revoked the compromised package, notified the WordPress community, and released a patched version. Users were advised to delete the infected plugin files and reinstall the fresh copy. Rank Math also collaborated with security researchers to trace the source of the intrusion, which appeared to stem from a compromised third‑party dependency.
The company offered a free security audit for sites that had installed the infected version. They also announced plans to strengthen their build pipeline, adding multi‑factor authentication and automated integrity checks. WordPress.org updated its plugin repository to block the malicious package until the issue was resolved.
The incident underscores the risk of relying on third‑party plugins. Even well‑established tools can be compromised if their supply chain is not secured. Site owners should verify the integrity of plugin files, keep backups, and monitor for suspicious activity. If a plugin is flagged, immediate removal and replacement with a verified version are essential. WordPress security experts recommend using a reputable security plugin that scans for malicious code.
The attack also highlights the importance of timely updates. Users who delayed updating their plugins may have unknowingly installed the infected version. Rank Math’s response demonstrates the need for clear communication and swift action when a vulnerability is found. Site owners should stay informed through official channels and apply patches as soon as they are released.
Q1: How can I check if my Rank Math PRO plugin is infected? A1: Compare the plugin’s hash with the one provided on Rank Math’s website. Run a malware scan with a trusted security plugin or use a service that checks for known malicious signatures.
Q2: Is my entire website at risk if I had the infected plugin installed? A2: The malware could allow remote code execution, but it typically requires the plugin to be activated. If you removed the plugin before activation, the risk is lower, though a full site audit is recommended.
Q3: Will future Rank Math releases be safe? A3: Rank Math has implemented stricter build and distribution controls. They will continue to monitor for vulnerabilities and release patches promptly. Users should keep the plugin updated and follow security best practices.