Rank Math Pro Plugin Distributed with Hidden Backdoor in Recent Supply‑Chain Attack

A recent supply‑chain breach has been linked to the Rank Math PRO WordPress plugin, where downloads from the official vendor site were found to contain malicious code that creates hidden backdoors on affected websites.

The malicious payload was discovered in a batch of plugin files released last week. Security researchers identified the code as a stealthy backdoor that can grant attackers remote access to compromised sites, potentially allowing them to alter content, steal data, or launch further attacks against visitors.

Rank Math is a popular SEO tool for WordPress, used by millions of site owners to improve search‑engine visibility. The plugin’s PRO version, which adds advanced features for premium users, is typically distributed directly from the developer’s website. By compromising the official download source, the attackers bypassed the usual trust that administrators place in legitimate software providers.

Supply‑chain attacks on open‑source and content‑management platforms have risen in recent years, with high‑profile incidents targeting widely used plugins and libraries. Because WordPress powers roughly a third of all websites, any vulnerability in its ecosystem can have a broad impact. Experts warn that even well‑maintained plugins can become vectors for malware if their distribution channels are infiltrated.

Following the discovery, the Rank Math development team issued an advisory, urging users to verify the integrity of their installations and to update to a clean version of the plugin. They also recommended scanning sites with reputable security tools and resetting any compromised credentials. The vendor has pledged to review its build and distribution processes to prevent future compromises.

Security professionals advise site owners to adopt a layered defense strategy: keep WordPress core, themes, and plugins up to date; employ file integrity monitoring; and restrict administrative access. For those who may have installed the infected version, a thorough cleanup—including removal of unknown files and a review of user accounts—is essential before restoring normal operations.