Rank Math SEO PRO 3.0.123 - Backdoor via Supply Chain Compromise

Description

The plugin was distributed with malicious code in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC, which could compromise a website if the plugin was activated.
Affected build: version 3.0.123, only packages obtained during the vendor-confirmed window above. Version 3.0.123 alone is not sufficient to establish compromise. The vendor removed the affected files and released version 3.0.124 as the clean replacement.
The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server.
Indicators of compromise listed by the vendor: three malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker.
Sites that activated an affected package should be treated as compromised.