Search — “wp-includes/class-wp-cache-util.php”

Rank Math PRO 3.0.123, downloaded from the vendor's official site between Oct 15 20:02 UTC and Oct 16 07:12 UTC, carried malware that establishes persistent access, talks to rank1cdn[.]com and recreates hidden backdoors on site visits. A related PHP sample creates the wp-includes/class-wp-cache-util.php backdoor, adds 'wpsupport_' admin accounts with '@wp-mail.net' emails, uses a '#ms6v46' cron marker and the '_np5pvf754c' DB option, executes commands, and steals cloud credentials and SSH keys. Hunters should look for those file, DB, cron and account artifacts, for outbound traffic to rank1cdn[.]com, and for web server processes spawning shells. Fix by updating to 3.0.124 or restoring from a clean backup.