Rank Math PRO Plugin Downloads Found Laden with Backdoor Malware in Recent Supply‑Chain Breach

Security researchers have confirmed that a batch of Rank Math PRO WordPress plugin downloads from the official website was laced with malicious code last week, creating hidden backdoors that could give attackers remote access to compromised sites.

Rank Math, a widely used SEO tool for WordPress, powers millions of blogs and business sites worldwide. Because the plugin is installed directly from the developer's repository, any compromise of the distribution channel can instantly affect a large number of sites without users realizing the threat.

The investigation, led by an independent security firm, identified a stealthy payload embedded in the plugin's core files. The code silently registers a backdoor endpoint that can be triggered remotely, allowing an attacker to upload additional files, execute commands, or exfiltrate data. The malicious version appeared in downloads between March 20 and March 26, according to the researchers' timeline.

Sites that installed the infected version may already be vulnerable. While no large‑scale data theft has been publicly reported, the backdoor’s capabilities mean that compromised sites could be used for further malicious activity, such as hosting phishing pages, distributing spam, or mining cryptocurrency. Administrators who updated the plugin during the affected window are urged to scan their installations for unexpected files and monitor server logs for unusual activity.

Rank Math’s development team issued a statement acknowledging the breach, confirming that the compromised files have been removed from the repository, and releasing a clean version of the plugin. The vendor advises users to delete the existing plugin folder, reinstall the latest official release, and change any passwords that may have been stored on the affected sites. They also pledged to enhance their code‑signing and distribution safeguards to prevent future incidents.

The episode underscores the broader risks inherent in the WordPress ecosystem, where thousands of third‑party plugins are regularly added to sites. Experts recommend that site owners rely on reputable sources, enable automatic updates where possible, and employ security plugins that can detect anomalous behavior. As supply‑chain attacks become more common, the incident serves as a reminder that even trusted software can become a vector for compromise if distribution channels are not rigorously protected.