Rank Math PRO WordPress Plugin Downloads Compromised with Backdoor Malware

What Happened

According to BleepingComputer, some downloads of the Rank Math PRO WordPress SEO plugin — distributed from the vendor's own official website — were tampered with to include malware. The compromised downloads planted hidden backdoors on websites that installed them, in what is being described as a supply-chain attack occurring last week. Details on the scope, duration of exposure, and specific backdoor mechanics have not yet been fully disclosed.

Why It Matters

Rank Math is a widely used SEO plugin in the WordPress ecosystem. A compromise at the distribution point — rather than a vulnerability in the plugin's code itself — means that site owners who trusted the official source and followed normal update/install practices could still end up with a backdoored site. This is a reminder that supply-chain trust in a plugin vendor's own infrastructure is not a given, and that affected sites may have hidden, persistent access points planted by an unknown third party.

Who's Affected

WordPress site operators who downloaded or updated Rank Math PRO from the vendor's official website during the affected window are potentially at risk. The exact timeframe and which specific builds were tampered with have not been detailed in current reporting.

What Defenders Should Do Now

• Review when and from where Rank Math PRO was installed or updated on any managed WordPress sites, and compare against vendor guidance once an official advisory and affected-version list are published.
• Audit WordPress installations for unfamiliar admin users, unexpected scheduled tasks (WP-Cron entries), modified theme/plugin files outside of normal update channels, and unknown PHP files in plugin or uploads directories.
• Hunt for outbound connections from WordPress hosts to unfamiliar domains or IPs, which can indicate a backdoor checking in to a C2 server.
• Check file integrity/hashes of installed Rank Math PRO files against known-good versions once the vendor or researchers publish indicators of compromise.
• Consider rotating WordPress admin, database, and hosting credentials for any site that ran a potentially affected build, out of caution.

Developing Story

This is net-new intelligence and details are still emerging — the full scope of affected downloads, the specific backdoor behavior, and vendor remediation steps have not yet been fully confirmed in public reporting. Defenders should treat the above as general hygiene steps rather than a confirmed indicator list, and follow the original coverage for updates: BleepingComputer: WordPress SEO plugin Rank Math compromised to backdoor websites.