CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Rank Math SEO PRO

product · product:rank-math-seo-pro single-source-victim

Coverage
1
first 2026-10-18 → last 2026-10-18
Latest activity
2026-10-18
Some Rank Math PRO 3.0.123 downloads carried malware; updating to 3.0.124 does not remove what it left
Peak priority
notable
1 notable
Targets
technology
sectors: technology
Sources cited
2
2 hosts

Action items (1)

Do-now tasks recorded on the entries about Rank Math SEO PRO, newest first. Check the date before acting on an older one.

  • Find every WordPress site that your organisation, its web agencies or its hosting suppliers run with Rank Math PRO and establish whether 3.0.123 was downloaded or updated between 2026-10-15 20:02 UTC and 2026-10-16 07:12 UTC; on a site where it was activated, restore from a backup older than that window or, if cleaning by hand, delete the whole rank-math-pro folder and the malicious database options first, because the backdoor is rebuilt on page visits, and rotate every credential the site could reach.
    2026-10-18Some Rank Math PRO 3.0.123 downloads carried…

Defender insights

What each entry about Rank Math SEO PRO tells a defender to do, newest first.

2026-10-18NOTABLESome Rank Math PRO 3.0.123 downloads carried malware; updating to 3.0.124 does not remove what it left

Exposure · detection

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

affected by

Story timeline

  1. 2026-10-18Rank Math SEO PRO 3.0.123: some packages served for about eleven hours carried malware that can leave hidden backdoors, rogue administrators and cron persistence that the update to 3.0.124 does not remove
    active-threatsSome Rank Math PRO 3.0.123 downloads carried malware; updating to 3.0.124 does not remove what it left

Hunting pivots

Releases covered
Rank Math SEO PRO
Tags
patch-availablesupply-chain
ATT&CK techniques (5 across 5 tactics)

5 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessSupply Chain Compromise: Compromise Software Supply Chain
  • ExecutionScheduled Task/Job: Cron
  • PersistenceScheduled Task/Job: Cron · Create Account: Local Account · Server Software Component: Web Shell
  • Privilege EscalationScheduled Task/Job: Cron
  • Credential AccessUnsecured Credentials: Credentials In Files

Initial Access TA0001

T1195.002Supply Chain Compromise: Compromise Software Supply Chain×1

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.

Evidence: 2026-10-18/rank-math-seo-pro-3-0-123-malware-supply-chain · ATT&CK page ↗

Execution TA0002

T1053.003Scheduled Task/Job: Cron×1

Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code. The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.

Evidence: 2026-10-18/rank-math-seo-pro-3-0-123-malware-supply-chain · ATT&CK page ↗

Persistence TA0003

T1053.003Scheduled Task/Job: Cron×1

Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code. The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.

Evidence: 2026-10-18/rank-math-seo-pro-3-0-123-malware-supply-chain · ATT&CK page ↗

T1136.001Create Account: Local Account×1

Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.

Evidence: 2026-10-18/rank-math-seo-pro-3-0-123-malware-supply-chain · ATT&CK page ↗

T1505.003Server Software Component: Web Shell×1

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.

Evidence: 2026-10-18/rank-math-seo-pro-3-0-123-malware-supply-chain · ATT&CK page ↗

Privilege Escalation TA0004

T1053.003Scheduled Task/Job: Cron×1

Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code. The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.

Evidence: 2026-10-18/rank-math-seo-pro-3-0-123-malware-supply-chain · ATT&CK page ↗

Credential Access TA0006

T1552.001Unsecured Credentials: Credentials In Files×1

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

Evidence: 2026-10-18/rank-math-seo-pro-3-0-123-malware-supply-chain · ATT&CK page ↗

Entries about Rank Math SEO PRO (1)

2026-10-18 · view entry permalink →

NOTABLENATOA2

Rank Math SEO PRO 3.0.123: some packages served for about eleven hours carried malware that can leave hidden backdoors, rogue administrators and cron persistence that the update to 3.0.124 does not remove

Rank Math says that some copies of Rank Math PRO 3.0.123, downloaded between 2026-10-15 20:02 UTC and 2026-10-16 07:12 UTC, contained malware that could compromise a website if the plugin was activated, and that it removed the files and released 3.0.124 (Rank Math, 2026-10-16). It says the malware can recreate its hidden backdoor whenever someone visits the website, so removing suspicious files before disabling the mechanism that recreates them may not resolve the infection (Rank Math, 2026-10-16). Wordfence adds that the malware may establish persistent access, contact a remote host, and expose WordPress credentials, database credentials, API keys and other secrets that the web server can reach, and that Rank Math says it holds records of who downloaded an affected copy (Wordfence, 2026-10-17). The signs Rank Math lists are three malicious entries in the WordPress options table, hidden PHP backdoors in the must-use plugins directory and in other plugin and theme folders, unknown administrator accounts, a fake core file under wp-includes, .htaccess rules that let .cache files run as PHP, PHP files in the uploads directory and a web-user cron entry carrying a marker comment (Rank Math, 2026-10-16).

We recently identified a security issue affecting a limited number of users who downloaded Rank Math PRO v3.0.123 between October 15, 2026, at 20:02 UTC and October 16, 2026, at 07:12 UTC.

The affected plugin files contained malware that could compromise your website if the plugin was activated.

The malware can recreate its hidden backdoor whenever someone visits the website.

Rank Math 2026-10-16

Simply updating the plugin is not enough because the malware may have placed additional files, administrator accounts, or scheduled tasks elsewhere on the server.

Wordfence 2026-10-17
incident18 Oct 03:31Zsingle-source · victim disclosureOpen finding →
Sources: Rank Math · Wordfence

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • rankmath.com1 (50%)
  • wordfence.com1 (50%)
All cited sources (2)