Source: thehackernews.com
The popular WordPress SEO plugin Rank Math PRO was compromised in a supply chain attack. Malicious copies were distributed via the official rankmath.com website and as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026. The tampered plugin versions contained malware designed to install a self-restoring backdoor on affected WordPress sites. Any site that installed and activated one of the compromised versions should be treated as fully compromised. Rank Math issued a security notice on October 16 disclosing the incident. The self-restoring nature of the backdoor makes remediation particularly challenging, as simply removing the plugin may not fully clean the infection.
