Hacked Site through the Rank Math / class-sitemap-index.php file

#98797
  • Resolved Kevin Sean
    Rank Math free

    Hello,
    A site on my server has been hacked, the url redirects to spam sites.
    An autogenerate WordPress email identified the problem coming from the rank math plugin.

    An error of type E_COMPILE_ERROR was caused in line 11 of the file /absolute/path/myurl.com/html/wp-content/plugins/seo-by-rank-math/includes/modules/sitemap/class-sitemap-index.php. Error message: Namespace declaration statement has to be the very first statement or after any declare call in the script

    Has anyone else experienced this?
    -best
    Kevin

Viewing 12 replies - 1 through 12 (of 12 total)
  • Hello

    Thank you for contacting the support and sorry for any inconvenience that might have been caused due to that.

    Assuming you are using the latest version of all the plugins, themes, and WordPress (please update if not yet), it would seem like a conflict with one of the plugins or the theme you are using.

    To determine that, please follow this troubleshooting guide:
    https://rankmath.com/kb/check-plugin-conflicts/

    Only the site admin would know and your users won’t be affected by this troubleshooting.

    Looking forward to helping you.

    you think a plug in conflict is redirecting my url to spam sites?… time to go back to yoast… thanks.

    Alberto
    Rank Math business

    Hello,

    I am sorry, that is not what we mean. I think my colleague suggested that since it could help us to debug the source of the issue (for example if it is just Rank Math affected or any other).

    If you prefer, we can take a look for you and try to solve this. To do that, please edit the first post on this ticket and include your WordPress logins in the designated Sensitive Data section.
    Sensitive Data Section

    It is completely secure and only our support staff has access to that section. If you want, you can use the below plugin to generate a temporary login URL to your website and share that with us instead:

    https://wordpress.org/plugins/temporary-login-without-password/

    You can use the above plugin in conjunction with the WP Security Audit Log to monitor what changes our staff might make on your website (if any):

    https://wordpress.org/plugins/wp-security-audit-log/

    We really look forward to helping you.

    Ok, thanks, I’m not sure what else to do.

    -bes
    Kevin

    • This reply was modified 4 years, 1 month ago by Kevin Sean.

    probably I will need to disable the site map file through phpmyadmin or ftp do you think?

    Alberto
    Rank Math business

    Hello,

    I will send this to our devs so they can help you by checking it in deep. Could you also share some FTP credentials so they can check some debug files and so on?

    Looking forward to help you.

    Hello,

    I have updated the sensitive data as requested. Can you please check further?

    Thank you.

    Ok thanks guys. Let me know if you need anything else.
    -best
    Kevin

    Hi Alberto,
    When will the devs get a chance to look at this?
    -best
    Kevin

    Hello,

    First of all, please note that your website was not hacked due to Rank Math.

    The email you received from WordPress is standard for when there are issues loading your website. But, it does not mean the email is saying that your website was hacked due to Rank Math. In fact, we have over 500K active installations of the plugin and it would be a huge disaster if a website was hacked due to Rank Math. If one website was hacked, pretty much all 500K websites are vulnerable but this is definitely not the case and if it were, WordPress would have intervened as do not allow vulnerable plugins to be listed on their platform.

    Now with that out of the way, let us try to find out why you received that email.

    Namespace related issues occur when your theme or one of your plugins (apart from Rank Math) is declaring the namespace as well. What that means in layman terms is that another plugin is trying to do what Rank Math does.

    The error message in your OP is Namespace declaration statement has to be the very first statement or after any declare call in the script and the filename mentioned is seo-by-rank-math/includes/modules/sitemap/class-sitemap-index.php

    If you open that file in any text editor, you will notice that namespace is indeed the first thing mentioned there:

    The text above it is comments.

    So, we can rule out the namespace issue is due to Rank Math.

    We tried logging into your website to diagnose the issue further but we keep getting redirected to spam website. Please get in touch with your web host to do a cleanup or restore to the previous known good configuration.

    Once we are able to login, we would love to check the issue but please know that your website was not hacked due to Rank Math as even the email you received suggests an issue that is completely unrelated to the hack.
    https://sitecheck.sucuri.net/results/magicdragonbagua.com

    Hope that helps and let us know if you have any followup queries.

    I provided my ftp details as you requested, so the “seo-by-rank-math/includes/modules/sitemap/class-sitemap-index.php” file is easily accessible to you. Perhaps the malware attack could have gotten in through another plug-in, if that’s what you are suggesting, I don’t know. I am going by the wordpress diagnostic, which clearly says that rank math is the cause. Again, from the eamil:

    As per the wordpress diagnostic:

    Howdy!

    Since WordPress 5.2 there is a built-in feature that detects when a plugin or theme causes a fatal error on your site, and notifies you with this automated email.

    In this case, WordPress caught an error with one of your plugins, Rank Math SEO.

    That is from the diagnostic generated email from wordpress. I will share it on the rankmath facebook group to see if anybody can help me there.

    Hello,

    That email means there was an issue with the plugin loading but that does not automatically mean that Rank Math is vulnerable.

    There has to be a plugin conflict because Rank Math is working fine for the rest of 500K+ users.

    If you need further help or with anything else, please open a new support ticket here so we can help:

    https://support.rankmath.com

    We are always here for assistance.

    Hello,

    Since we did not hear back from you for 15 days, we are assuming that you found the solution. We are closing this support ticket.

    If you still need assistance or any other help, please feel free to open a new support ticket, and we will be more than happy to assist.

    Thank you.

Viewing 12 replies - 1 through 12 (of 12 total)

The ticket ‘Hacked Site through the Rank Math / class-sitemap-index.php file’ is closed to new replies.