Rank Math PRO WordPress plugin compromised in supply chain attack

Downloads and updates of the Rank Math PRO WordPress plugin were compromised in a supply chain attack that planted hidden backdoors on websites, BleepingComputer, The Hacker News, and SecurityWeek reported. Rank Math stated that the incident affected version 3.0.123 downloaded from its website or delivered as updates between October 15, 2026, at 20:02 UTC and October 16, 2026, at 07:12 UTC. [1][2][3]

The compromised plugin files contained malware that could allow attackers to compromise or take over affected websites once activated, BleepingComputer and SecurityWeek reported. The Hacker News and Cyber Kendra both added that the malware delivered in the compromised downloads functions as a self-restoring backdoor. [1][2][3][5]

Rank Math is a search engine optimization tool plug-in for WordPress. The plugin features an automated setup wizard for XML sitemap generation and basic settings, real-time post analysis evaluating over 40 optimization factors, and a schema generator for structured data. [8]

The supply chain attack follows earlier WordPress security issues. As FTMQ Security reported earlier, hackers previously exploited cross-site scripting flaws tracked as CVE-2026-93836 and CVE-2026-94504 in Ninja Forms and WPC Product Bundles for WooCommerce to install backdoors and create unauthorized administrator accounts. [9]

Rank Math issued a security notice regarding the compromised plugin packages after removing the malicious files and warning affected users who downloaded version 3.0.123 during the 11-hour exposure window, BleepingComputer and The Hacker News reported. [1][2]