Rank Math PRO Plugin Downloads Contaminated with Backdoor Malware in Recent Supply‑Chain Attack

Security analysts verified that a set of Rank Math PRO WordPress plugin downloads obtained from the official site was embedded with malicious code last week, installing covert backdoors that could grant attackers remote control over compromised sites.

Rank Math, a popular SEO solution for WordPress, powers millions of blogs and business sites around the globe. Because the plugin is fetched directly from the developer's repository, any compromise of that distribution channel can instantly affect a vast number of installations without users noticing the danger.

The probe, conducted by an independent security firm, uncovered a hidden payload placed within the plugin's core files. This code quietly registers a backdoor endpoint that can be invoked remotely, enabling an attacker to upload additional files, run commands, or siphon data. The tainted version was present in downloads dated between March 20 and March 26, according to the researchers' timeline.

Websites that installed the compromised version may already be exposed. Although no large‑scale data breach has been publicly disclosed, the backdoor’s capabilities mean affected sites could be leveraged for further malicious actions such as hosting phishing pages, spreading spam, or mining cryptocurrency. Administrators who updated the plugin during the affected period are advised to scan their installations for unexpected files and watch server logs for anomalous activity.

Rank Math’s development team released a statement acknowledging the incident, confirming that the infected files have been removed from the repository, and providing a clean version of the plugin. The vendor recommends users delete the existing plugin folder, reinstall the latest official release, and change any passwords stored on the compromised sites. They also pledged to strengthen code‑signing and distribution safeguards to avert future breaches.

The episode highlights the wider risks inherent in the WordPress ecosystem, where thousands of third‑party plugins are routinely added to sites. Experts advise site owners to source plugins from reputable locations, enable automatic updates whenever possible, and employ security tools that can spot abnormal behavior. As supply‑chain attacks grow more frequent, this incident serves as a reminder that even trusted software can become an attack vector if distribution channels are not rigorously secured.