Reported by 2 outlets
The story so far
AI summary of the reporting below · Updated · How we work
Rank Math announced that an 11-hour supply-chain attack compromised downloads of its Rank Math PRO WordPress plugin version 3.0.123 from its official site between October 15 at 20:02 UTC and October 16 at 07:12 UTC. The company quickly pulled the infected files and released a clean update, version 3.0.124. The incident affected only the commercial release, leaving the free version on WordPress.org untouched. [1][2]
Once activated, the malware establishes persistent access, contacts rank1cdn.com, and recreates hidden backdoors upon site visits, according to the vendor. The breach exposes database credentials, API keys, and server secrets. Rank Math warned that deactivating or simply updating the plugin will not remove the threat; administrators must restore clean backups or manually eradicate malicious database entries, unauthorized administrator accounts, and altered system files. [1]
Some downloads of the Rank Math PRO WordPress plugin from the vendor's official website carried malware that planted hidden backdoors in a supply-chain attack last week.
via BleepingComputerHackers injected malware into Rank Math PRO version 3.0.123 packages distributed between October 15 and October 16.
via SecurityWeek