Rank Math PRO downloads were compromised to backdoor WordPress sites

[PixelBear]

Some downloads of a popular WordPress SEO plugin contained hidden malware. BleepingComputer's Bill Toulas reports that copies of Rank Math PRO downloaded from the vendor's own website planted backdoors on sites, in a classic supply chain attack

The bad version is 3.0.123, downloaded between 20:02 UTC on 15 October and 07:12 UTC on 16 October. The clean release is 3.0.124. Importantly, the free version on WordPress.org, which is active on more than four million sites, was not affected

The malware keeps persistent access, contacts a command server and recreates its backdoors if they are removed. That exposes database credentials and API keys. BleepingComputer found a matching sample that creates admin accounts named wpsupport_ and can steal credentials for AWS, Cloudflare, Google Cloud and Azure

Rank Math warns that simply deactivating or updating the plugin does not remove the threat. It recommends restoring the site from a clean backup made before the infection and changing every secret, from database passwords to cloud keys

Supply chain attacks on WordPress plugins are especially dangerous because site owners trust updates from vendors they pay. With the PHP emergency happening at the same time, it has been a very rough week for WordPress admins. Anyone who downloaded Rank Math PRO during that window should act now

How do you vet plugin updates before installing them? And should premium plugin vendors face stricter security requirements?

WordPress SEO plugin Rank Math compromised to backdoor websiteswww.bleepingcomputer.com