Rank Math PRO 3.0.123 Tainted in Two-Day Supply-Chain Push

Key points

• Rank Math PRO 3.0.123 was compromised and made available for roughly two days, October 15–16.
• The event is a supply-chain intrusion: malicious code entered legitimate plugin packages.
• No CVE identifier exists, so detection depends on version checks, file integrity, and logs.
• WordPress site owners should treat installs or updates from the window as potentially untrusted.

Sites running the Rank Math PRO WordPress plugin are responding to a supply-chain intrusion after unidentified threat actors inserted malicious code into version 3.0.123. The tainted release was made available for about 48 hours, spanning October 15 and October 16. No CVE identifier has been issued for the event.

The affected product is a WordPress plugin from Rank Math, and the distribution path itself was abused rather than a flaw in site code. That means ordinary update workflows could have pulled compromised packages onto otherwise healthy installations. The actors have not been identified.

Because the plugin sits in the WordPress ecosystem, exposure is not limited to one site type. K-12 districts, government portals, and other organizations that operate WordPress should check whether they installed or updated Rank Math PRO during the two-day window. Sites that did should treat the installation as potentially untrusted until files and logs are reviewed.

The absence of a CVE does not make the event low risk. Supply-chain malware can persist through backups, staging copies, and automated deployment pipelines, and it may evade signature-based checks if the payload was custom or recently rotated. Severity is high because the compromise touched the software delivery path, not just a single endpoint.

What to watch: unexpected admin accounts, modified plugin files, outbound connections from web servers, and re-downloaded packages that fail integrity checks. Organizations should compare hashes against a known-good release, review web server and update logs around October 15–16, and monitor for reinfection after cleanup.

What to do now

1. Inventory all WordPress instances and identify any running Rank Math PRO 3.0.123; isolate or take offline sites that installed or updated it between October 15 and October 16.
2. Replace the plugin with a clean, vendor-verified build from an official source, then compare file hashes and remove unexpected files or scheduled tasks.
3. Scan the full site, database, uploads, themes, and mu-plugins for malicious code; check for unauthorized admin users, altered .htaccess, and injected JavaScript.
4. Review web server, WAF, and update logs for the two-day window; look for outbound callbacks, suspicious POSTs, and package download anomalies.
5. Rotate WordPress admin, database, SFTP/SSH, API, and deployment credentials if compromise is suspected; invalidate active sessions.
6. Restore from a known-clean backup only after confirming the backup predates the tainted release, and redeploy from a trusted pipeline.
7. Add integrity monitoring and staged update controls for third-party plugins; alert on version changes and file modifications.

Original source

SecurityWeek