DEV Community

Anoymask
Anoymask

Posted on

Rank Math PRO 3.0.123 Supply Chain Compromise: Backdoor Can Regenerate on Page Visits

#security #threatintel

1. Basic Information

2. Quick Summary

Malware was injected into a subset of Rank Math PRO 3.0.123 packages distributed during a specific time window on October 15-16, 2026. The vendor recommends treating sites that activated the tampered version as compromised and investigating backdoor regeneration on each page visit, unauthorized administrator accounts, cron jobs, and server-side modifications.

3. Attack Flow

Activation and Persistence of the Tampered Plugin

  1. A user downloads or updates Rank Math PRO 3.0.123 from official channels during the affected time window (October 15, 20:02 UTC to October 16, 07:12 UTC).
  2. Activating the tampered plugin allows the malware to install execution mechanisms within the WordPress environment and database.
  3. The malware can regenerate hidden backdoors triggered by page visits. The vendor lists unauthorized administrator accounts, disguised core and cache PHP files, and cron jobs as investigation targets. Their presence and sequence must be checked individually; these artifacts were not confirmed uniformly across all sites.
  4. The vendor recommends treating credentials and API keys accessible from the site as potentially exposed, replacing them, and investigating server areas outside of WordPress. Actual data theft and server-side modifications must be verified individually for each site.
Deployment Status Target Version Conditions Treatment Based on Vendor Recommendations Key Required Actions
Obtained during the affected window and activated, including later activation Version 3.0.123 obtained between Oct 15 20:02 and Oct 16 07:12 UTC (activation after the distribution window is still included) Treated as compromised Restore the site and database from a clean pre-incident backup (or execute manual removal steps), deploy 3.0.124, rotate all secrets, and perform server-side investigations
Downloaded during the affected window but never activated Version 3.0.123 obtained between Oct 15 20:02 and Oct 16 07:12 UTC that was never activated Do not confirm compromise based solely on this incident Delete the tampered package, deploy clean version 3.0.124, and run a malware scan as a precaution
Free version only Rank Math SEO (Free version) Out of scope Not affected by this PRO package tampering

4. Attacker Position and Prerequisites

  • The attacker can inject malware into the Rank Math PRO distribution package and targets WordPress administrators who trust official updates.

5. What Victims and Administrators See

Victim Side

  • The site may appear to function normally on the surface, and page visits by regular users trigger the regeneration of backdoors.

Administrator Side

  • Appears as version 3.0.123 installation history, specific entries in wp_options, outbound communication to rank1cdn.com, administrator accounts formatted as wpsupport_*, disguised core and cache files, and suspicious cron jobs or tasks.

6. Success and Failure Conditions

Success Conditions

  • Activation of the tampered version 3.0.123 obtained during the affected window on the site. Activation time occurring after the end of the distribution window does not exclude the site if the obtained package was tampered with.
  • Execution of the plugin's PHP code with write permissions required for subsequent operations. OS-level cron registration or modification permissions outside the WordPress directory are not mandatory requirements for all initial executions.

Failure Conditions and Defensive Branches

  • If never activated, do not treat the incident as a confirmed compromise based solely on this event; instead, delete the package, deploy clean version 3.0.124, and perform a scan.
  • For manual recovery, delete the rank-math-pro folder, remove malicious database entries, block outbound communication to rank1cdn.com if possible, and then investigate remaining files. Disabling the plugin via the management dashboard alone is insufficient.

7. What Happens Upon Success

  • Full compromise of the website and database along with persistent PHP code execution.
  • Exposure of secrets such as passwords, database credentials, and API keys.
  • Potential SEO spam, malicious redirects, additional malware deployment, and compromise of accounts on the hosting server.

8. Observable Logs

The following are candidates for investigation. Availability depends on the product, privileges, log settings, and retention periods; absence of logs does not prove the absence of compromise.

  • Email: Check for impact notification emails from Rank Math and recorded plugin update timestamps.
  • Proxy/SWG/DNS: Check for outbound communications from the web server to rank1cdn[.]com.
  • Endpoint/EDR: Check for rank-math-pro, fake class-wp-cache-util.php, PHP files with .cache extensions, base64_decode combined with XOR decoding, proc_open calls, and cron entries containing #ms6v46.
  • Identity/IdP: Check for administrator account creation using wpsupport_* or @wp-mail[.]net, unknown administrator logins, and unauthorized API key usage.
  • SaaS/Cloud: Check hosting management panels, backup settings, deployment history, and change logs in secret management services.
  • Network: Check for outbound communication from the web server to unknown destinations and suspicious requests to the site.

9. Scope of Success Verification

Vendor Recommendations and Individual Site Determination

  • Scope: Recovery recommendations apply to sites that activated the tampered version obtained during the affected time window. Cases of download without activation are not included in this determination, and the presence of subsequent compromises on individual sites must be determined based on actual evidence.
  • Basis: Criteria: The vendor recommended restoring sites that activated the affected version under the assumption of compromise. The creation of unauthorized administrators, cron registrations, server-level persistence, and theft of sensitive information on individual sites require separate confirmation through evidence and were not confirmed uniformly across all sites.

Determination Criteria for Your Organization

  • Separate contact, execution, information acquisition, and subsequent compromise; do not infer unconfirmed success from a single alert.

10. Investigation Playbook

  • Investigation Origin: Start from the download and activation history of version 3.0.123, vendor notifications, or matches with public IOCs.
  • Initial Verification: Confirm timestamps for downloads, updates, and activations, backup creation times, distinction between free and PRO versions, and execution permissions of the hosting environment.
  • Terminal/Server Investigation: Preserve the plugin files, wp_options, mu-plugins, themes, disguised core and cache files, .htaccess, cron, and authorized_keys.
  • Authentication/Cloud Investigation: Verify WordPress, hosting, database, API, and SSH credentials along with the presence of unfamiliar administrator accounts.
  • Subsequent Actions: Expand the investigation scope to areas outside the web root, other sites on the same server, shared hosting accounts, and outbound C2 traffic.
  • Containment: Restrict external traffic, restore the website and database from a clean pre-incident backup, deploy version 3.0.124, and rotate all secrets.
  • Judgment Categories: Distinguish step-by-step between download only, plugin activation, backdoor installation, secret theft, and server-level persistence.

11. Defense and Detection Ideas

  • Single Event: Detect the creation of specified keys in wp_options, addition of wpsupport_* format administrator accounts, and creation of class-wp-cache-util.php.
  • Timeline Correlation: Correlate plugin update -> activation -> wp_options modification -> suspicious PHP file generation -> administrator addition and cron registration -> outbound communication in chronological order.
  • Threat Hunting: Hunt for combinations of base64_decode and the XOR key xmmqhn, proc_open, PHP-FPM socket communication code, and settings that execute .cache files as PHP.
  • Log Limitations: Normal site appearance does not rule out compromise, and shared hosting environments may prevent direct access to OS-level artifacts.
  • Priority Countermeasures: Prioritize restoration from clean backups, rotation of all secrets, monitoring of outbound communications, and server-level investigations.

12. Facts / Inference / Hypothesis

Facts

  • The affected packages are Rank Math PRO version 3.0.123 downloaded or updated between October 15, 2026, 20:02 UTC and October 16, 2026, 07:12 UTC.
  • The free version Rank Math SEO is not affected, and the fixed clean version is 3.0.124.
  • The vendor treated sites that activated the affected version as compromised and recommended restoring the website and database from pre-incident backups.
  • Because the malware can regenerate hidden backdoors during page visits, simply disabling the plugin does not remove it.
  • Investigation indicators publicly released include _uf6qdn2hmm, t8krdk990phb, and _np5pvf754c in wp_options, rank1cdn.com, wpsupport_* administrator accounts, wp-mail[.]net, fake core file class-wp-cache-util.php, rules executing .cache as PHP, and cron entries containing #ms6v46.
  • The vendor instructed users to assume passwords, database credentials, API keys, and other secrets were exposed and to replace them.

Inference

  • Cleaning up only within the WordPress directory risks overlooking server-level modifications such as SSH authorized_keys or system crontab; therefore, the entire hosting account must be included in the investigation scope.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in Unknowns and Further Investigation.

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1195.002 Supply Chain Compromise: Compromise Software Supply Chain high Malware was injected into a subset of officially distributed PRO packages. Definition
T1136.001 Create Account: Local Account medium The vendor recommends checking for unauthorized WordPress administrator accounts. Actual creation status on individual sites must be verified separately. Definition
T1053.003 Scheduled Task/Job: Cron medium Corresponds to system crontab cited by the vendor for investigation. Do not equate internal WordPress scheduled events with OS cron; persistence on each site must be verified separately. Definition

14. Unknowns and Further Investigation

  • Initial entry vectors into the distribution environment, total affected download counts, attacker attribution, and breakdowns of subsequent operations actually executed on each site have not been disclosed.
  • Because official recovery steps do not detail how the PHP backdoor receives external requests and processes commands, mapping to Web Shell (T1505.003) is withheld.

15. Impact on SOCs and Organizations

When operating WordPress sites, including corporate websites and media outlets, organizations must isolate the impact scope based on package acquisition time and activation status rather than merely checking version numbers. If using shared hosting, organizations need to coordinate with their hosting provider to proceed with server-level investigations.

16. Audience-Specific Summary

  • For SOCs: Chronologically verify specific entries in wp_options, communications to rank1cdn.com, unauthorized administrator accounts, fake core and cache files, and cron registrations.
  • For Administrators: For sites that activated the tampered version 3.0.123 obtained during the affected time window, restore the site and DB from a clean pre-incident backup, redeploy version 3.0.124, and rotate all credentials and other secrets that were accessible from the site. Do not exclude sites simply because activation occurred after the distribution window.
  • For Users: If asked by a site administrator to reset your password, change it promptly, and do the same for any other services where you reuse the same password.

Top comments (0)