A popular SEO plugin shipped malware last week

Some paid copies of the Rank Math WordPress plugin carried a backdoor, which is hidden access that lets an attacker into your site. International Cyber Digest reports that the affected files were PRO version 3.0.123, downloaded on 15 and 16 October.

Rank Math says sites that activated one of those copies should treat passwords and API keys as exposed. An API key is a secret code that connects your site to another service, so anything from your email tool to your payment provider could be reachable if one leaked.

International Cyber Digest

@IntCyberDigest

X

Rank Math says sites that activated one should treat passwords and API keys as exposed.

What to do if you use Rank Math

First, work out whether this touches you at all. The reports point at paid PRO copies downloaded on those two days. If you did not download or update Rank Math PRO on 15 or 16 October, nothing here describes your site.

If you did, act as though the credentials on that site are in someone else's hands. Change your WordPress admin passwords. Change the passwords for any other accounts that share those passwords. Then go through every service connected to your site and generate fresh API keys, switching off the old ones.

Also check which version of the plugin is running now. In WordPress, open Plugins, find Rank Math, and look at the version number next to it. Update to the newest version available.

Why people are annoyed

The anger is less about the bug and more about how it got out. SEO Charles Floate said Rank Math had "accidentally backdoored everyone's site" and asked how the distribution got compromised in the first place.

This is a reminder that a plugin is code you let run on your site. Every plugin you install is one more thing that can go wrong. If you have plugins sitting there that you do not use, delete them rather than leaving them switched off.

Charles Floate 📈

@Charles_SEO

X

RankMath accidentally backdoored everyone's site