Act
active
Rank Math PRO WordPress Plugin Hijacked to Deliver Self-Restoring Backdoor
- Engineer — Act: Any WordPress site that installed or activated Rank Math PRO between 20:02 UTC Oct 15 and 07:12 UTC Oct 16 should be treated as fully compromised; audit all WordPress deployments for that plugin version and initiate full incident response including checking for the self-restoring persistence mechanism.
- SOC/IR — Act: Sweep all monitored WordPress environments for Rank Math PRO installs or updates within the compromised window and apply assume-breach posture to any hits; the self-restoring backdoor means passive log review is insufficient — active host investigation is needed.
- Leader — Act: Confirm whether any company-owned or agency-managed web properties use Rank Math PRO and whether they were updated during the October 15–16 window; if exposure exists, initiate IR and assess whether customer-facing sites may have been serving malicious content.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.