Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack
BLUF
Rank Math PRO version 3.0.123 was abused as a malware delivery channel in a supply chain attack affecting WordPress sites that installed or updated to the plugin during the compromised window.
NEWS
SecurityWeek reported that malicious code was inserted into Rank Math PRO version 3.0.123 packages distributed between October 15 and October 16. The compromise affects users who obtained the plugin through normal update or installation channels during that period, turning a trusted WordPress extension into an infection vector.
Why I Care
Supply chain attacks are dangerous because they bypass user caution by abusing trusted software, potentially giving attackers persistent access to WordPress sites. Sites running the affected version may be exposed to backdoors, credential theft, site defacement, SEO spam injection, or further malware installation.
Next Steps
Site owners and administrators should immediately identify any Rank Math PRO 3.0.123 installations from October 15-16, remove or replace the plugin with a verified clean version from an official source, run a full malware scan, review admin accounts and file integrity, rotate WordPress and database credentials, and check for unauthorized changes or scheduled tasks.
Source: Security Week ·