Rank Math PRO Updates Were Poisoned for 11 Hours. Any Site That Pulled One Is Owned.
A paid WordPress SEO plugin trusted on millions of sites shipped malicious updates for part of October 15 and 16. The backdoor rebuilds itself if you delete it.
Key points
- Downloads and auto-updates of Rank Math PRO served from rankmath.com between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, per a security notice the company published on October 16.
- Rank Math's free version runs on over 4 million active WordPress sites; the paid PRO tier is a smaller paying subset whose exact count has not been disclosed.
- The planted code is a self-restoring backdoor: deleting the obvious file is not enough, because the malware rewrites itself from hidden copies elsewhere on the site.
- Any site that installed or auto-updated Rank Math PRO inside the 11-hour window should be treated as fully compromised, not just patched.
- This is a supply-chain attack: the attackers poisoned the official source rather than tricking owners into installing something fake.
For roughly 11 hours between the evening of October 15 and the morning of October 16, the official download server for Rank Math PRO handed out a sabotaged copy of the plugin to its paying customers.
Rank Math is one of the most widely used search-optimisation tools on WordPress. The free version runs on more than four million sites. PRO is the paid tier, and PRO is the one that got hit.
If your WordPress site pulled an update, or you downloaded a fresh copy from rankmath.com, between 20:02 UTC on October 15 and 07:12 UTC on October 16, you didn't get the plugin you paid for. You got the plugin plus a backdoor.
What actually happened?
Someone tampered with the files Rank Math itself was distributing. Instead of breaking into thousands of websites one by one, the attackers broke into the one place thousands of sites trust for updates, then let WordPress's own auto-update feature handle delivery.
The company confirmed the window and the malicious payload in a security notice on October 16, as first reported by The Hacker News. Rank Math has not, at time of writing, said publicly how the attackers reached its distribution system. That question matters: we've reported on two earlier cases this year where WordPress plugin vendors' own infrastructure was turned against their customers, and each time the vendor's build pipeline was the gap no one had audited.
Why is "self-restoring" the scary word here?
Most backdoors are a single file. Delete it, and you're clean. This one isn't built that way.
The planted code copies pieces of itself into other parts of the WordPress installation. If a site owner spots the obvious file and removes it, the hidden copies notice and rebuild the backdoor from scratch. A normal "update to the clean version and move on" response will leave the attackers inside.
That's why Rank Math is telling affected customers to treat the whole site as compromised, not just the plugin.
What should site owners do right now?
Check your update history. If the plugin updated, or you downloaded it fresh, inside the 11-hour window, assume compromise and act accordingly.
| Detail | What Rank Math says |
|---|---|
| Affected product | Rank Math PRO (paid version only) |
| Window start | 20:02 UTC, October 15 |
| Window end | 07:12 UTC, October 16 |
| Source of bad files | rankmath.com downloads and auto-updates |
| Recommended response | Treat site as fully compromised |
A full response means more than reinstalling the plugin. Rotate every WordPress administrator password, rotate database credentials, rotate any API keys the site stored, audit user accounts for admins you didn't create, and ideally restore from a backup taken before October 15. Hosting providers with WordPress-aware malware scanners can help locate the hidden copies.
For the millions of sites on the free version of Rank Math, this incident doesn't apply. The compromise was in the paid PRO distribution only.
Should you worry about this happening again?
The self-healing design is the real story. A supply-chain hit lasting 11 hours is bad but survivable; a payload engineered to outlast the obvious cleanup is what turns this from an embarrassing week for Rank Math into weeks of forensic work for its paying customers. The uncomfortable question for the vendor is how its own release pipeline got reached in the first place, and it's the same question that went unanswered after the Admin Menu Editor Pro poisoning in September. Until vendors treat their build and distribution infrastructure as attack surface, their customers keep absorbing the risk.
