In a twist of fate that no one saw coming—probably because they were too busy optimizing their websites—Rank Math PRO, the beloved WordPress SEO plugin, has had a little mishap. If you downloaded version 3.0.123 between October 15th and 16th, congratulations! You may have unwittingly installed a delightful malware package that opens backdoors to your precious website. What a treat!
According to the vendor, a "limited number" of users were affected. That's a comforting way of saying, "We have no earthly idea how many of you are now vulnerable." So, what’s the scoop? The plugin files you downloaded contained malware that could compromise your entire website when activated. But don’t worry! Rank Math has promptly released a cleaner version—Rank Math PRO v3.0.124—so you can continue to pretend everything's fine.
Details We Don't Want to Hear
The vendor assures us that only the PRO version was compromised. So, if you were wisely using the free version—active on a jaw-dropping 4 million sites—good news! You escaped this digital disaster. Rank Math claims that the malware establishes a persistent access to your site and chats away with ‘rank1cdn[.]com’ like it’s the best friend no one wanted.
The fine print? Users who accidentally activated the infected plugin may have exposed sensitive information like database credentials and API keys. Because who doesn't love sharing their secrets?
The Scary Stuff
While digging through the murky depths of this attack, our friends at BleepingComputer found some PHP malware linked to the Rank Math incident. Just in case you were wondering what that looks like: a delightful script named 'cache-preloader-fff033 (1).php'. It aimed to deploy additional backdoors, execute commands, and yank away sensitive keys like AWS, Google Cloud, and Azure—because why not?
Cleanup Procedures: Enjoy the DIY Experience!
For anyone who suspects their site has been compromised, the cleanup procedures are about as fun as a dentist appointment. You’ll want to restore from a clean backup (good luck finding one) and rotate all your passwords. If you don’t have a backup, prepare for some tedious manual cleanup. Rank Math suggests you delete the entire plugin folder. That's right, the entire thing! In fact, you'll want to investigate for any additional backdoors or unexpectedly friendly administrator accounts. It’s like a treasure hunt, but with much higher stakes and much less gold.
Blocking all outbound connections to that rank1cdn[.]com domain is also highly recommended. Because, you know, your website should probably stop chatting with shady places.
And for those lucky souls who installed the plugin but never activated it—delete that bad boy, grab the new version, and pray your website is still standing.
Final Thoughts
BleepingComputer tried to get in touch with Rank Math for some numbers—like how many sites are potentially affected—but the silence was deafening.
So, in the realm of WordPress plugins, always remember: if it sounds too good to be true, it might just come with an unexpected backdoor. Keep your websites safe, folks.
