Both The Hacker News and SecurityWeek report that attackers injected malware into Rank Math PRO version 3.0.123 packages distributed between 20:02 UTC on October 15 and 07:12 UTC on October 16. The Hacker News adds that the free Rank Math SEO plugin on WordPress.org is not affected, while SecurityWeek provides a concise summary of the supply chain compromise without additional technical detail.
The malware can recreate its hidden backdoor whenever someone visits the site, and may leave PHP backdoor files, administrator accounts, a fake WordPress core file, and scheduled tasks. Both sources agree that any site that installed and activated the affected plugin should be treated as compromised. The Hacker News notes that updating to the clean 3.0.124 does not remove these artifacts, so a full cleanup is necessary.
Recovery, as detailed by The Hacker News, involves restoring from a pre-attack backup if one exists, or following a manual cleanup order: delete the plugin folder, remove specific wp_options entries, block outbound connections to rank1cdn[.]com, then search for backdoor files and rogue accounts. Credentials should be changed in all cases. SecurityWeek does not cover these steps, but both sources confirm that a clean version is available from rankmath.com.