Rank Math SEO Plugin Hijacked with Self‑Restoring Backdoor

On October 15–16, copies of the paid version of the Rank Math SEO plugin were distributed via rankmath.com or delivered as updates between 20:02 UTC Oct 15 and 07:12 UTC Oct 16 containing malware. The vendor’s security notice issued on October 16 warned that any site that had installed one of those copies should be treated as compromised.¹

The payload was a self‑restoring backdoor that leveraged web shells hidden inside image files. Once removed by administrators, cron jobs or scheduled tasks automatically restored the malicious code, making cleanup difficult without deep forensic analysis looking at scheduled task activity alongside file integrity checks across all plugins and themes installed on affected servers.¹

This incident underscores how trusted third‑party components can become vectors for sophisticated attacks. Similar behavior was observed last year when attackers injected malicious code into Cloudflare WAF modules, exploiting the trust placed in widely used infrastructure providers.¹

Experts note that an attacker likely compromised the build process or distribution channel—injecting malicious updates directly into rankmath.com itself. Self‑restoring backdoors rely heavily on persistence mechanisms such as web shells hidden inside image files which automatically restore themselves after removal by system administrators using cron jobs/scheduled tasks – making cleanup significantly harder without deep forensic analysis. This parallels earlier incidents involving supply chain compromises within home media server ecosystems and highlights the need for continuous monitoring of update channels.¹

Rank Math is one of the most downloaded WordPress SEO plugins, with estimates exceeding 1 million active installations worldwide. A persistent backdoor threatens not only site owners but also end users whose data may be exfiltrated or manipulated. The use of image files to hide shell scripts illustrates a new layer of obfuscation that evades traditional signature‑based detection tools. The persistence mechanism allows attackers to maintain control even after initial removal attempts.¹

Site owners are advised to verify plugin versions against official hashes, monitor scheduled tasks for unexpected entries, and employ security tools capable of detecting anomalous file changes. While a patch has not yet been released, awareness of this vulnerability is crucial for protecting user data and maintaining privacy on WordPress installations worldwide.¹