Rank Math PRO, the paid edition of a widely used WordPress SEO plugin, was the vehicle for a supply-chain attack that planted hidden backdoors on websites that downloaded or updated the software through official channels, according to both Bleeping Computer and The Hacker News.
What happened
According to The Hacker News, Rank Math issued a security notice on October 16 confirming that copies of the plugin distributed from rankmath.com — whether as fresh downloads or automatic updates — contained malware during a window that ran from 20:02 UTC on October 15 to 07:12 UTC on October 16. That amounts to just over eleven hours of exposure.
Bleeping Computer described the incident as a supply-chain attack in which the compromised installer planted hidden backdoors on affected WordPress installations.
Self-restoring backdoor
The Hacker News noted that the backdoor was described as self-restoring, meaning it is designed to persist even after an initial cleanup attempt. As a result, any site that installed or activated one of the tainted plugin copies should be treated as fully compromised rather than simply patched.
What site owners should do
Because the backdoor can restore itself, a straightforward plugin update or removal may not be sufficient to secure an affected site. Site owners who installed or updated Rank Math PRO during the exposure window are encouraged to conduct a thorough security audit of their WordPress installation, review user accounts and file integrity, and follow any remediation guidance published in Rank Math's official security notice.
Neither source provided a confirmed count of how many sites were affected or detailed the specific mechanism by which the vendor's distribution infrastructure was compromised.
