Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor

How the Backdoor Persists After Removal

A compromised version of the paid Rank Math PRO plugin for WordPress was distributed through official channels between October 15 and October 16, containing malware designed to install a persistent backdoor on affected websites. The tainted copies were made available for download from rankmath.com or delivered as automatic updates during a specific time window, according to a security notice issued by the company on October 16. Any site that installed and activated one of these versions may have been exposed to unauthorized access.

The malicious code was embedded within the plugin files and executed upon activation, allowing attackers to gain control over compromised WordPress installations. Rank Math confirmed that the breach affected only the PRO version of the plugin and was limited to downloads and updates occurring between 20:02 UTC on October 15 and 07:12 UTC on October 16. The company stated that the malware included self-restoring mechanisms, meaning it could reinstall itself even after initial removal if not fully eradicated. Users were advised to immediately update to a clean version and audit their sites for signs of intrusion.

What Should Website Owners Do Now?

The malware used in the attack employed techniques to survive standard cleanup procedures, including hiding within core WordPress files and reactivating through scheduled tasks or hidden admin users. Security researchers noted that the backdoor could reestablish communication with external servers controlled by attackers, enabling ongoing data theft or further injection of malicious code. Rank Math emphasized that simply deactivating the plugin was insufficient; complete removal required manual inspection of server files, database entries, and cron jobs. The firm provided a step-by-step guide to help users identify and eliminate all traces of the compromise.

Site administrators who suspect they installed the affected version should immediately update Rank Math PRO to the latest secure release from the official repository. They should also reset all WordPress passwords, check for unfamiliar admin accounts, and review file integrity using security plugins or server logs. Hosting providers were urged to scan shared environments for cross-site contamination. Rank Math confirmed that the free version of the plugin was not affected and that the breach originated from a compromised build process, not a vulnerability in the plugin’s code itself. The company has since implemented additional safeguards to prevent similar incidents.

How can I tell if my site was infected? Look for unknown admin users, unexpected files in wp-content or wp-includes, and unusual outgoing connections in server logs. Security plugins may flag suspicious activity.

Frequently Asked Questions

Is the free version of Rank Math safe to use? Yes, Rank Math confirmed that only the PRO version was impacted during the specified time window, and the free release remains uncompromised.

Will updating the plugin remove the backdoor? Updating alone may not be enough; users must also manually verify and clean their site to ensure all remnants of the malware are eradicated.