Rank Math PRO downloads carried malware

Rank Math said a limited number of users who downloaded Rank Math PRO version 3.0.123 during an 11-hour window received altered files. The company said activation of those files could lead to compromise of the websites using them.

The vendor said the malware could keep access in place, contact rank1cdn[.]com and recreate hidden backdoors when someone visited the infected site. It also warned that affected sites could expose database credentials, API keys and other secrets available to the web server.

BleepingComputer said it found a PHP file on VirusTotal that appeared related to the incident and matched indicators listed in Rank Math’s advisory, including an XOR key, a WordPress database entry marker, a cron job marker and code that could create administrator accounts. The publication said the sample also contained code to run commands, alter databases and steal credentials and keys for AWS, Cloudflare, Google Cloud and Azure.

Rank Math advised site owners to restore clean backups, scan systems and rotate passwords, keys and salts. It also said that simply disabling or updating the plugin after compromise would not remove the threat, and that affected users without safe backups would need manual clean-up.