{ "type": "bundle", "id": "bundle--8dd4e5f0-57d1-5fb6-8f36-eefb398eb57d", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--15a39b6d-25a1-5c63-821d-eaa362c1c622", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "org:420b649c-87db-4a30-9fd3-3469552c9d29", "name": "Rank Math", "identity_class": "organization" }, { "type": "incident", "spec_version": "2.1", "id": "incident--04861112-eed0-581e-85f5-8e6ef756c9af", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "inc:5008eb19-f07c-40a9-9f86-2c37c9640ae7", "name": "Rank Math PRO plugin malware incident" }, { "type": "incident", "spec_version": "2.1", "id": "incident--82c96c8b-8cb5-5ba1-853f-766a4d5a7a02", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "brh:0fb2000c-7230-4f79-8cbf-3ba33256b266", "name": "Rank Math PRO plugin malware incident" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--56daf9ad-d428-5db6-8f5b-747ec221ba97", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:2ffcb2fc-9a40-44d1-9160-2fc4074f6754", "relationship_type": "resulted-in", "source_ref": "incident--04861112-eed0-581e-85f5-8e6ef756c9af", "target_ref": "x-ally-event--b1df40ce-2d49-57db-84e9-d807e65b705c", "confidence": 100, "external_references": [ { "source_name": "Rank Math", "url": "https://rankmath.com/kb/pro-3-0-123-security-incident/", "external_id": "cit:c424d5e9-7072-48d4-afca-62c7d5e9bde9", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:307ba9900f8e7a80466e4ef7972d92ece84605b6644216ccafe964fcb80fd7ef" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--98b5c2c5-5bf8-537d-8339-a25561da5a7a", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:1aefd230-f1dd-4d5f-bb22-d687d16d3aba", "relationship_type": "resulted-in", "source_ref": "incident--04861112-eed0-581e-85f5-8e6ef756c9af", "target_ref": "x-ally-event--1a4b73b5-bb46-5051-81a3-fcad28b78a60", "confidence": 100, "external_references": [ { "source_name": "Rank Math", "url": "https://rankmath.com/kb/pro-3-0-123-security-incident/", "external_id": "cit:9dbc53a2-e0a3-4eb8-bcfe-14d3caeca6d4", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:307ba9900f8e7a80466e4ef7972d92ece84605b6644216ccafe964fcb80fd7ef" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b3b8adda-012b-5620-8631-ccf12374a8e0", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:a317f1de-57e1-4c27-ae1e-da222415449f", "relationship_type": "affected-organization", "source_ref": "incident--04861112-eed0-581e-85f5-8e6ef756c9af", "target_ref": "identity--15a39b6d-25a1-5c63-821d-eaa362c1c622", "confidence": 100, "external_references": [ { "source_name": "Rank Math", "url": "https://rankmath.com/kb/pro-3-0-123-security-incident/", "external_id": "cit:e77203f8-14fc-43a0-93ea-a6904e70e2b2", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:307ba9900f8e7a80466e4ef7972d92ece84605b6644216ccafe964fcb80fd7ef" } ] }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--02236272-f419-5660-8759-3589b7a0d011", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:801c7fdb-82e2-4a33-803f-d807434d9160", "confidence": 100, "external_references": [ { "source_name": "Rank Math", "url": "https://rankmath.com/kb/pro-3-0-123-security-incident/", "external_id": "cit:56f7a6aa-6d62-4764-bbef-78fa31606f0b", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:307ba9900f8e7a80466e4ef7972d92ece84605b6644216ccafe964fcb80fd7ef" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Activating the affected plugin could compromise a website; downloading without installation or activation does not by itself establish website compromise." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--0d758ead-edd1-51c3-8d76-6da2697d4c50", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:6f4999fd-46b9-40e3-890b-63e0d8f1a140", "confidence": 100, "external_references": [ { "source_name": "Rank Math", "url": "https://rankmath.com/kb/pro-3-0-123-security-incident/", "external_id": "cit:6ed3421d-131d-4a31-a938-e7546d1dc3ca", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:307ba9900f8e7a80466e4ef7972d92ece84605b6644216ccafe964fcb80fd7ef" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-10-15" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--1bb97df5-a232-59ac-87b9-dfdacb62f09a", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:dbe83a92-50eb-4f73-a8aa-2d891a4a38c1", "confidence": 100, "external_references": [ { "source_name": "Rank Math", "url": "https://rankmath.com/kb/pro-3-0-123-security-incident/", "external_id": "cit:df1fcf30-9a3c-4aac-8c6a-b162c0daa81c", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:307ba9900f8e7a80466e4ef7972d92ece84605b6644216ccafe964fcb80fd7ef" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Rank Math removed the affected files and released clean version 3.0.124." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--21cd161d-0e21-5080-89b5-3fc1f118d44b", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:47eb3d01-1b8f-4a94-813e-ef4b5b80b399", "confidence": 100, "external_references": [], "x_ally_claim_object": { "kind": "iri", "value": "https://attack.mitre.org/techniques/T1195/002/" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--4dd2835d-4ee9-55e9-8fa6-706f587e2a01", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:d4ebd2d5-1c10-45d4-bb49-4fef1e096977", "confidence": 100, "external_references": [ { "source_name": "Rank Math", "url": "https://rankmath.com/kb/pro-3-0-123-security-incident/", "external_id": "cit:26c27bd5-8191-4d37-b8c0-3c5a07b4f77f", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:307ba9900f8e7a80466e4ef7972d92ece84605b6644216ccafe964fcb80fd7ef" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "For activated copies, Rank Math recommended restoring a clean backup or a thorough cleanup, replacing credentials and then installing the clean release." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--9699948d-2233-5a03-86da-145f0172fb58", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:97ebaed9-3ade-43f6-9826-64cb7edc805d", "confidence": 100, "external_references": [ { "source_name": "Rank Math", "url": "https://rankmath.com/kb/pro-3-0-123-security-incident/", "external_id": "cit:e1f6743c-280e-49f7-be13-29bdae8388ac", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:307ba9900f8e7a80466e4ef7972d92ece84605b6644216ccafe964fcb80fd7ef" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-10-16" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--c45f62cf-48c3-5102-80d2-a44561682628", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:a9d847b9-c473-4963-b67a-471a7b7aad69", "confidence": 100, "external_references": [ { "source_name": "Rank Math", "url": "https://rankmath.com/kb/pro-3-0-123-security-incident/", "external_id": "cit:19a8e573-4399-4ac8-9633-48a868381621", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:307ba9900f8e7a80466e4ef7972d92ece84605b6644216ccafe964fcb80fd7ef" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "The malware could recreate a hidden backdoor when the website received visits, making removal of individual files insufficient." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--c994aec4-e635-52f7-83b0-d0e01c2f504a", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:fa59f074-37bf-4bda-b4eb-21a5bfd4a7da", "confidence": 100, "external_references": [ { "source_name": "Rank Math", "url": "https://rankmath.com/kb/pro-3-0-123-security-incident/", "external_id": "cit:bb2af679-d9ae-4acf-9a56-18f9fb5f2e0a", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:307ba9900f8e7a80466e4ef7972d92ece84605b6644216ccafe964fcb80fd7ef" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Rank Math confirmed malware in PRO version 3.0.123 downloads supplied between October 15 at 20:02 UTC and October 16 at 07:12 UTC." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--cf881fec-8932-59fc-82c8-5e55fabf1b44", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:7ca9d1bb-cec9-4903-ad55-e6de09fef5dc", "confidence": 100, "external_references": [ { "source_name": "Rank Math", "url": "https://rankmath.com/kb/pro-3-0-123-security-incident/", "external_id": "cit:115d4fc5-96bb-44a7-8600-7ee00b0fd0e5", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:307ba9900f8e7a80466e4ef7972d92ece84605b6644216ccafe964fcb80fd7ef" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-10-16" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--e95a2169-a934-5660-89cf-1002512cd253", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "clm:1c82991e-7d73-435f-996b-fb3dd6095835", "confidence": 100, "external_references": [ { "source_name": "Rank Math", "url": "https://rankmath.com/kb/pro-3-0-123-security-incident/", "external_id": "cit:91a26720-a82d-4652-a897-17ddacc70210", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:307ba9900f8e7a80466e4ef7972d92ece84605b6644216ccafe964fcb80fd7ef" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "The vendor said the free Rank Math SEO plugin on WordPress.org was not affected by this incident." } }, { "type": "x-ally-event", "spec_version": "2.1", "id": "x-ally-event--1a4b73b5-bb46-5051-81a3-fcad28b78a60", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "evt:8212b888-dbc4-41fa-8218-f54b75dd8640", "name": "Affected distribution window began" }, { "type": "x-ally-event", "spec_version": "2.1", "id": "x-ally-event--b1df40ce-2d49-57db-84e9-d807e65b705c", "created": "2026-10-21T14:54:33.960571+00:00", "modified": "2026-10-21T14:54:33.960571+00:00", "x_ally_original_id": "evt:48279ca5-5b68-43d4-b7f7-aafc548e35ac", "name": "Affected distribution window ended and notice published" } ] }