{"id":277,"date":"2026-10-17T11:03:55","date_gmt":"2026-10-17T09:03:55","guid":{"rendered":"https:\/\/helloblog.io\/hr\/rank-math-pro-3-0-123-zlonamjerni-kod-oporavak\/"},"modified":"2026-10-17T11:03:55","modified_gmt":"2026-10-17T09:03:55","slug":"rank-math-pro-3-0-123-zlonamjerni-kod-oporavak","status":"publish","type":"post","link":"https:\/\/helloblog.io\/hr\/rank-math-pro-3-0-123-zlonamjerni-kod-oporavak\/","title":{"rendered":"Rank Math PRO 3.0.123: zlonamjerni kod u slu\u017ebenim paketima i koraci za oporavak"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Dio paketa Rank Math PRO 3.0.123, dostupnih kroz slu\u017ebeni kanal za preuzimanje i a\u017euriranje, sadr\u017eavao je zlonamjerni kod. Kod se pokretao kad biste aktivirali dodatak, a mogao je napada\u010du osigurati trajni pristup web-stranici. \u010cista verzija <strong>3.0.124<\/strong> zamjenjuje datoteke dodatka, ali ne uklanja nu\u017eno datoteke, administratorske ra\u010dune i zakazane zadatke koje je zlonamjerni kod ve\u0107 stvorio drugdje.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ako odr\u017eavate WordPress stranice za sebe ili klijente, prvo provjerite kada ste preuzeli paket i jeste li ga aktivirali. Sama oznaka verzije 3.0.123 nije dokaz kompromitacije, no ni novija verzija nije dokaz da je stranica \u010dista ako ste prethodno aktivirali zara\u017eeni paket.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u0160to se dogodilo i koje su verzije zahva\u0107ene<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Ovo je <strong>napad na lanac opskrbe<\/strong>: napada\u010d je zlonamjerni kod ubacio u slu\u017ebeni paket koji korisnici preuzimaju ili dobivaju kroz a\u017euriranje. Nije rije\u010d o programskoj pogre\u0161ci u dodatku koju napada\u010d iskori\u0161tava izvana. Rank Math uklonio je zahva\u0107ene pakete i objavio \u010distu verziju 3.0.124.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>Dodatak:<\/strong> Rank Math SEO PRO, s identifikatorom dodatka, odnosno slugom, <code>seo-by-rank-math-pro<\/code>.<\/li>\n\n\n<li><strong>Zahva\u0107ena verzija:<\/strong> samo dio paketa verzije 3.0.123, preuzetih u odre\u0111enom vremenskom intervalu.<\/li>\n\n\n<li><strong>Razdoblje:<\/strong> od 15. listopada 2026. u 20:02 UTC do 16. listopada 2026. u 07:12 UTC, pribli\u017eno 11 sati.<\/li>\n\n\n<li><strong>Vrijeme u Hrvatskoj:<\/strong> od 15. listopada u 22:02 do 16. listopada u 09:12 po srednjoeuropskom ljetnom vremenu, CEST.<\/li>\n\n\n<li><strong>\u010cista verzija:<\/strong> 3.0.124.<\/li>\n\n\n<li><strong>Identifikator ranjivosti:<\/strong> CVE-2026-111862. Sustav Common Vulnerability Scoring System (CVSS) dodjeljuje ocjenu 9,8, odnosno kriti\u010dnu ozbiljnost. Zapis opisuje ugra\u0111eni zlonamjerni kod za koji napada\u010du ne treba prethodna autentifikacija.<\/li>\n\n\n<li><strong>Opseg incidenta:<\/strong> obavijest se odnosi na PRO dodatak; besplatni Rank Math nije naveden kao zahva\u0107en.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Rank Math ima evidenciju korisnika koji su preuzeli zahva\u0107ene kopije i \u0161alje im obavijesti. Ako ste dobili takvu obavijest, slijedite odgovaraju\u0107i postupak \u010dak i ako sada koristite drugu verziju. Nije objavljeno kako je napada\u010d izmijenio pakete, tko stoji iza napada ni koliko je stranica kompromitirano.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Zlonamjerni kod komunicira s domenom <code>rank1cdn[.]com<\/code> i mo\u017ee ponovno stvarati skrivena stra\u017enja vrata, odnosno kod koji omogu\u0107uje neovla\u0161ten pristup, kad netko posjeti stranicu. Ugro\u017eava WordPress vjerodajnice, pristupne podatke za bazu, API klju\u010deve i druge tajne koje proces web-poslu\u017eitelja mo\u017ee pro\u010ditati. Zbog toga oporavak mora obuhvatiti cijelu instalaciju, a ne samo direktorij dodatka.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Kako utvrditi koji se postupak odnosi na vas<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">U WordPress administraciji otvorite <strong>Dodaci<\/strong> i provjerite instaliranu verziju Rank Math PRO. Zatim provjerite kada ste preuzeli paket i jeste li ga aktivirali: ta dva podatka odre\u0111uju sljede\u0107i korak.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>Instalirali ste i aktivirali zahva\u0107eni paket 3.0.123:<\/strong> tretirajte stranicu kao kompromitiranu. Vratite \u010distu sigurnosnu kopiju ili slijedite sve korake za ru\u010dno \u010di\u0161\u0107enje.<\/li>\n\n\n<li><strong>Instalirali ste zahva\u0107eni paket 3.0.123, ali ga nikad niste aktivirali:<\/strong> izbri\u0161ite njegove datoteke, instalirajte \u010distu verziju 3.0.124 sa svojeg Rank Math ra\u010duna i preventivno pokrenite sigurnosni pregled.<\/li>\n\n\n<li><strong>Preuzeli ste paket 3.0.123, ali ga niste instalirali ni aktivirali:<\/strong> sam ovaj incident ne upu\u0107uje na to da je stranica kompromitirana. Ako ne mo\u017eete utvrditi jesu li datoteke ipak bile instalirane ili je dodatak bio aktivan, obratite se <a href=\"https:\/\/rankmath.com\/support\/\">podr\u0161ci<\/a>.<\/li>\n\n<\/ul>\n\n\n\n<div class=\"wp-block-group callout callout-warning is-style-warning is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">A\u017eurirati dodatak nije isto \u0161to i o\u010distiti stranicu<\/h4>\n\n\n<p class=\"wp-block-paragraph\">Verzija 3.0.124 zamjenjuje paket Rank Math PRO. Ne bri\u0161e automatski zlonamjerne datoteke iz drugih direktorija, ne uklanja neovla\u0161tene administratore i ne uklanja zadatke koje je napada\u010d dodao u cron.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Brza provjera kroz WP-CLI<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">WP-CLI, alat za rad s WordPressom iz naredbenog retka, mo\u017ee ubrzati po\u010detnu provjeru. Sljede\u0107e naredbe provjeravaju verziju dodatka, poznate zapise u bazi, administratore, WordPress core i zakazane zadatke. One slu\u017ee za pregled i same ne \u010diste instalaciju.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly># Pokrenite iz direktorija WordPress instalacije.\nwp plugin get seo-by-rank-math-pro --field=version\n\n# Provjerite sva tri poznata naziva zlonamjernih opcija.\nwp option get _uf6qdn2hmm\nwp option get t8krdk990phb\nwp option get _np5pvf754c\n\nwp user list --role=administrator --fields=ID,user_login,user_email,user_registered\nwp core verify-checksums\nwp cron event list\n\n# Ova datoteka nije dio legitimnog WordPress corea.\nls -la wp-includes\/class-wp-cache-util.php\n\n# www-data zamijenite stvarnim korisnikom web-poslu\u017eitelja.\n# Za pregled tu\u0111eg crontaba trebaju odgovaraju\u0107e ovlasti.\ncrontab -l -u www-data | grep 'ms6v46'\n\n# Potra\u017eite poznati klju\u010d u datotekama unutar wp-content.\ngrep -RIn -- 'xmmqhn' wp-content\/\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#6A737D\"># Pokrenite iz direktorija WordPress instalacije.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> plugin<\/span><span style=\"color:#9ECBFF\"> get<\/span><span style=\"color:#9ECBFF\"> seo-by-rank-math-pro<\/span><span style=\"color:#79B8FF\"> --field=version<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\"># Provjerite sva tri poznata naziva zlonamjernih opcija.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> option<\/span><span style=\"color:#9ECBFF\"> get<\/span><span style=\"color:#9ECBFF\"> _uf6qdn2hmm<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> option<\/span><span style=\"color:#9ECBFF\"> get<\/span><span style=\"color:#9ECBFF\"> t8krdk990phb<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> option<\/span><span style=\"color:#9ECBFF\"> get<\/span><span style=\"color:#9ECBFF\"> _np5pvf754c<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> user<\/span><span style=\"color:#9ECBFF\"> list<\/span><span style=\"color:#79B8FF\"> --role=administrator<\/span><span style=\"color:#79B8FF\"> --fields=ID,user_login,user_email,user_registered<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> core<\/span><span style=\"color:#9ECBFF\"> verify-checksums<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> cron<\/span><span style=\"color:#9ECBFF\"> event<\/span><span style=\"color:#9ECBFF\"> list<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\"># Ova datoteka nije dio legitimnog WordPress corea.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">ls<\/span><span style=\"color:#79B8FF\"> -la<\/span><span style=\"color:#9ECBFF\"> wp-includes\/class-wp-cache-util.php<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\"># www-data zamijenite stvarnim korisnikom web-poslu\u017eitelja.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\"># Za pregled tu\u0111eg crontaba trebaju odgovaraju\u0107e ovlasti.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">crontab<\/span><span style=\"color:#79B8FF\"> -l<\/span><span style=\"color:#79B8FF\"> -u<\/span><span style=\"color:#9ECBFF\"> www-data<\/span><span style=\"color:#F97583\"> |<\/span><span style=\"color:#B392F0\"> grep<\/span><span style=\"color:#9ECBFF\"> 'ms6v46'<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\"># Potra\u017eite poznati klju\u010d u datotekama unutar wp-content.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">grep<\/span><span style=\"color:#79B8FF\"> -RIn<\/span><span style=\"color:#79B8FF\"> --<\/span><span style=\"color:#9ECBFF\"> 'xmmqhn'<\/span><span style=\"color:#9ECBFF\"> wp-content\/<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Provjerite rezultate zajedno s vremenom preuzimanja i povije\u0161\u0107u aktivacije dodatka. Ako ove naredbe ne prona\u0111u poznate tragove, to jo\u0161 nije potvrda da je stranica \u010dista: morate pregledati i ostala mjesta navedena u nastavku.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Prva mogu\u0107nost: vratite \u010distu sigurnosnu kopiju<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Ako ste aktivirali zara\u017eeni paket, preporu\u010deni je put vratiti datoteke i bazu iz sigurnosne kopije nastale prije po\u010detka incidenta. Kopija mora biti starija od <strong>15. listopada 2026. u 20:02 UTC<\/strong>, odnosno 22:02 CEST ili 16:02 EDT istoga dana. U vremenskoj zoni IST taj trenutak odgovara 16. listopada u 01:32.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li><strong>Vratite cijelu stranicu i bazu podataka<\/strong> iz \u010diste sigurnosne kopije nastale prije navedenog trenutka.<\/li>\n\n\n<li><strong>Pokrenite sigurnosni pregled<\/strong> pouzdanim alatom, primjerice dodatkom <a href=\"https:\/\/wordpress.org\/plugins\/wordfence\/\">Wordfence<\/a> ili <a href=\"https:\/\/wordpress.org\/plugins\/sucuri-scanner\/\">Sucuri<\/a>.<\/li>\n\n\n<li><strong>Promijenite sve potencijalno izlo\u017eene lozinke i vjerodajnice.<\/strong> Uklju\u010dite pristupne podatke za bazu, API klju\u010deve i ostale tajne prema detaljnom popisu u odjeljku o vjerodajnicama.<\/li>\n\n\n<li><strong>Instalirajte \u010distu verziju Rank Math PRO 3.0.124<\/strong> koju ste preuzeli sa svojeg Rank Math ra\u010duna.<\/li>\n\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Ako ne znate kako vratiti sigurnosnu kopiju, zatra\u017eite pomo\u0107 hosting podr\u0161ke. Lozinke i druge tajne morate promijeniti i nakon \u0161to vratite kopiju jer ih je napada\u010d u me\u0111uvremenu mogao pro\u010ditati.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Druga mogu\u0107nost: ru\u010dno o\u010distite instalaciju<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Ako nemate \u010distu sigurnosnu kopiju koju mo\u017eete vratiti, morate ukloniti zlonamjerni kod i provjeriti \u0161to je jo\u0161 napada\u010d promijenio. Redoslijed je va\u017ean jer posjet stranici mo\u017ee ponovno stvoriti skrivena stra\u017enja vrata.<\/p>\n\n\n\n<div class=\"wp-block-group callout callout-danger is-style-danger is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Prvo zaustavite mehanizam koji vra\u0107a zlonamjerne datoteke<\/h4>\n\n\n<p class=\"wp-block-paragraph\">Ako samo izbri\u0161ete sumnjivu datoteku, a ostavite aktivan mehanizam koji je ponovno stvara, problem mo\u017ee ostati. Ako niste sigurni kako raditi s datotekama, bazom i postavkama poslu\u017eitelja, prepustite ove korake hosting podr\u0161ci ili stru\u010dnjaku za sigurnost.<\/p>\n\n<\/div>\n\n\n\n<h3 class=\"wp-block-heading\">1. Onemogu\u0107ite ponovno stvaranje zlonamjernog koda<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Prije nego \u0161to po\u010dnete tra\u017eiti druge tragove, uklonite po\u010detni mehanizam zaraze. Dovr\u0161ite sve sljede\u0107e radnje, a tek zatim prije\u0111ite na drugi korak.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li><strong>Izbri\u0161ite cijeli direktorij Rank Math PRO.<\/strong> Kroz upravitelj datoteka na hostingu ili FTP prona\u0111ite i izbri\u0161ite direktorij <code>rank-math-pro<\/code>. Nije dovoljno samo deaktivirati dodatak.<\/li>\n\n\n<li><strong>Izbri\u0161ite zlonamjerne opcije iz baze.<\/strong> U alatu poput phpMyAdmina otvorite tablicu <code>wp_options<\/code> i uklonite svaki prona\u0111eni zapis \u010diji <code>option_name<\/code> glasi <code>_uf6qdn2hmm<\/code>, <code>t8krdk990phb<\/code> ili <code>_np5pvf754c<\/code>.<\/li>\n\n\n<li><strong>Blokirajte odlazne veze prema domeni <code>rank1cdn.com<\/code><\/strong>, ako hosting ili vatrozid podr\u017eava takvo pravilo.<\/li>\n\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">2. Prona\u0111ite dodatne datoteke, ra\u010dune i promjene na poslu\u017eitelju<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Napada\u010d je mogao ostaviti tragove izvan po\u010detnog direktorija dodatka. Pregledajte svaki od sljede\u0107ih dijelova instalacije i poslu\u017eitelja, \u010dak i ako ste ve\u0107 prona\u0161li i uklonili jednu zlonamjernu datoteku.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Skrivena stra\u017enja vrata u PHP datotekama<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Sumnjive PHP datoteke mogu se nalaziti u direktorijima drugih dodataka i tema. Tra\u017eite kod s pozivom <code>base64_decode<\/code> u kombinaciji s petljama koje koriste operaciju XOR, klju\u010dem <code>xmmqhn<\/code>, pozivom <code>proc_open<\/code> ili kodom za PHP-FPM socket, komunikacijsku to\u010dku prema procesu koji izvr\u0161ava PHP.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Pregledajte <code>wp-content\/mu-plugins\/<\/code>.<\/li>\n\n\n<li>Pregledajte direktorije drugih dodataka.<\/li>\n\n\n<li>U temama koje nisu zadane WordPress teme pregledajte direktorije <code>inc\/<\/code>, <code>includes\/<\/code> i <code>lib\/<\/code>.<\/li>\n\n\n<li>Pregledajte direktorij <code>includes\/<\/code> dodatka Rank Math.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Sigurnosni dodatak ili hosting podr\u0161ka mogu pomo\u0107i prona\u0107i te pokazatelje i ukloniti zlonamjerne datoteke. Nalaze provjerite u kontekstu koda, a ne samo po nazivu pojedine PHP funkcije.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Nepoznati administratorski ra\u010duni<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Napada\u010d je mogao dodati WordPress ra\u010dun s administratorskim ovlastima. Posebno provjerite korisni\u010dka imena koja po\u010dinju s <code>wpsupport_<\/code> i nastavljaju se nasumi\u010dnim znakovima te ra\u010dune s adresom e-po\u0161te na domeni <code>@wp-mail[.]net<\/code>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Pregledajte sve administratore, ne samo ra\u010dune koji odgovaraju tim obrascima. Uklonite ra\u010dune za koje potvrdite da su zlonamjerni ili neovla\u0161teni.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>wp user list --role=administrator\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> user<\/span><span style=\"color:#9ECBFF\"> list<\/span><span style=\"color:#79B8FF\"> --role=administrator<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<h4 class=\"wp-block-heading\">La\u017ena WordPress core datoteka<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Datoteka <code>wp-includes\/class-wp-cache-util.php<\/code> nije legitimni dio WordPress corea. Ako postoji, uklonite je i provjerite kontrolne zbrojeve, odnosno vrijednosti kojima alat uspore\u0111uje lokalne datoteke sa slu\u017ebenim kopijama.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>wp core verify-checksums\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> core<\/span><span style=\"color:#9ECBFF\"> verify-checksums<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Ponovno instalirajte WordPress core datoteke iz slu\u017ebenog izvora kako biste uklonili i mogu\u0107e izmjene drugih core datoteka. Nemojte stati na brisanju samo poznate la\u017ene datoteke.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Pravila u .htaccess i PHP kod u .cache datotekama<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Pravila u datoteci <code>.htaccess<\/code> mogu omogu\u0107iti da poslu\u017eitelj izvr\u0161ava <code>.cache<\/code> datoteke kao PHP. Pregledajte <code>.htaccess<\/code> u korijenskom direktoriju stranice i u svim poddirektorijima.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Na poslu\u017eitelju potra\u017eite i <code>.cache<\/code> datoteke koje sadr\u017ee PHP kod. Istra\u017eite svaki sumnjivi nalaz zajedno s pravilima koja odre\u0111uju kako se takve datoteke izvr\u0161avaju.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Zakazani zadaci u sustavu i WordPressu<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Zlonamjerni zadatak mo\u017ee ponovno pokretati napada\u010dev kod. U sistemskom crontabu, rasporedu zadataka za korisnika pod kojim radi web-poslu\u017eitelj, potra\u017eite stavke s oznakom <code>#ms6v46<\/code>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Pregledajte i doga\u0111aje u WP-Cronu, WordPressovu sustavu za zakazane zadatke. Istra\u017eite sumnjive stavke i uklonite one za koje potvrdite da su zlonamjerne.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>wp cron event list\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> cron<\/span><span style=\"color:#9ECBFF\"> event<\/span><span style=\"color:#9ECBFF\"> list<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<h4 class=\"wp-block-heading\">Ostali dodaci, teme i prenesene datoteke<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Izmjene mogu zahvatiti i dodatke ili teme koji nisu povezani s po\u010detnom zarazom. Ponovno ih instalirajte iz slu\u017ebenih izvora i, gdje mo\u017eete, usporedite postoje\u0107e datoteke s \u010distim kopijama.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>U direktoriju <code>uploads\/<\/code> potra\u017eite PHP datoteke jer ih ondje u pravilu ne bi trebalo biti.<\/li>\n\n\n<li>Istra\u017eite neo\u010dekivane i izmijenjene datoteke prije nego \u0161to ih uklonite.<\/li>\n\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Okru\u017eenje izvan WordPress instalacije<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Napada\u010deve promjene mogu se nalaziti i izvan direktorija web-stranice. Pregled poslu\u017eitelja zato mora obuhvatiti i sljede\u0107a mjesta.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Datoteke <code>authorized_keys<\/code> koje odre\u0111uju dopu\u0161tene SSH klju\u010deve.<\/li>\n\n\n<li>Crontabove drugih sistemskih korisnika.<\/li>\n\n\n<li>Aktivne procese.<\/li>\n\n\n<li>Lokacije izvan direktorija stranice u koje korisnik web-poslu\u017eitelja mo\u017ee pisati.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Na dijeljenom hostingu mo\u017eda ne\u0107ete imati pristup tim dijelovima sustava. Zatra\u017eite od hosting podr\u0161ke da ih provjeri.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. Zamijenite sve potencijalno izlo\u017eene vjerodajnice<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Sve tajne dostupne kompromitiranoj stranici tretirajte kao potencijalno izlo\u017eene. Ovaj korak ne smijete presko\u010diti ni ako ste vratili \u010distu sigurnosnu kopiju.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>Lozinke:<\/strong> promijenite lozinke WordPress ra\u010duna i sve ostale relevantne pristupne podatke koji su bili dostupni kompromitiranoj stranici.<\/li>\n\n\n<li><strong>Baza podataka:<\/strong> zamijenite korisni\u010dko ime i lozinku za bazu te a\u017eurirajte odgovaraju\u0107e vrijednosti u <code>wp-config.php<\/code>.<\/li>\n\n\n<li><strong>WordPress sigurnosni klju\u010devi i salt vrijednosti:<\/strong> generirajte nove vrijednosti u <code>wp-config.php<\/code>; WordPress ih koristi za za\u0161titu autentifikacije i sesija.<\/li>\n\n\n<li><strong>API klju\u010devi i pristup servisima:<\/strong> zamijenite klju\u010deve platnih servisa, SMTP vjerodajnice za slanje e-po\u0161te, API klju\u010deve i druge tajne iz postavki stranice ili konfiguracijskih datoteka. API je programsko su\u010delje preko kojeg stranica komunicira s drugim servisom.<\/li>\n\n\n<li><strong>Hosting i poslu\u017eitelj:<\/strong> promijenite vjerodajnice za hosting upravlja\u010dku plo\u010du, FTP\/SFTP i SSH pristup. Pregledajte i tajne pohranjene u varijablama okru\u017eenja.<\/li>\n\n\n<li><strong>Dvofaktorska autentifikacija:<\/strong> pregledajte postavke administratorskih ra\u010duna i ponovno ih postavite gdje je potrebno.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Nove vjerodajnice upi\u0161ite u konfiguraciju stranice i povezane servise svugdje gdje ih koristite. Ako ne mo\u017eete utvrditi sve potencijalno izlo\u017eene podatke, zatra\u017eite pomo\u0107 hosting podr\u0161ke ili stru\u010dnjaka za sigurnost.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. Provjerite rezultat \u010di\u0161\u0107enja<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\u010ci\u0161\u0107enje morate potvrditi pregledom datoteka i pra\u0107enjem pona\u0161anja stranice. Nakon \u0161to uklonite zlonamjerne tragove i zamijenite vjerodajnice, slijedite ovaj redoslijed.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li>Pokrenite sigurnosni pregled pouzdanim alatom poput Wordfencea ili Sucurija.<\/li>\n\n\n<li>Provjerite WordPress core naredbom <code>wp core verify-checksums<\/code>.<\/li>\n\n\n<li>Provjerite datoteke instaliranih dodataka naredbom <code>wp plugin verify-checksums --all<\/code>. Kontrolni zbrojevi nisu dostupni za svaki dodatak, osobito za premium dodatke; tada datoteke usporedite s \u010distom kopijom iz slu\u017ebenog izvora.<\/li>\n\n\n<li>Sljede\u0107ih dana pratite odlazne veze s poslu\u017eitelja i druge znakove sumnjive aktivnosti.<\/li>\n\n\n<li>Provjeravajte pojavljuju li se ponovno datoteke koje ste uklonili.<\/li>\n\n<\/ol>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>wp core verify-checksums\nwp plugin verify-checksums --all\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> core<\/span><span style=\"color:#9ECBFF\"> verify-checksums<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> plugin<\/span><span style=\"color:#9ECBFF\"> verify-checksums<\/span><span style=\"color:#79B8FF\"> --all<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Ako se zlonamjerne datoteke vrate ili primijetite neobi\u010dnu aktivnost, \u010di\u0161\u0107enje mo\u017eda nije potpuno. Vratite se na drugi korak ru\u010dnog postupka i uklju\u010dite hosting podr\u0161ku ili stru\u010dnjaka za sigurnost.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Pokazatelji kompromitacije na jednom mjestu<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Pokazatelji kompromitacije, odnosno IOC-ovi, poznati su tragovi koje mo\u017eete tra\u017eiti u datotekama, bazi i zapisima poslu\u017eitelja. Ovaj popis poma\u017ee pri pregledu, ali ne zamjenjuje cijeli postupak oporavka.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>Mre\u017ena komunikacija:<\/strong> domena <code>rank1cdn[.]com<\/code>.<\/li>\n\n\n<li><strong>Zapisi u <code>wp_options<\/code>:<\/strong> <code>_uf6qdn2hmm<\/code>, <code>t8krdk990phb<\/code> i <code>_np5pvf754c<\/code>.<\/li>\n\n\n<li><strong>PHP kod:<\/strong> klju\u010d <code>xmmqhn<\/code>, <code>base64_decode<\/code> u kombinaciji s XOR petljama, <code>proc_open<\/code> ili kod za PHP-FPM socket.<\/li>\n\n\n<li><strong>Administratori:<\/strong> korisni\u010dka imena oblika <code>wpsupport_<\/code> s nasumi\u010dnim nastavkom i adrese e-po\u0161te koje zavr\u0161avaju s <code>@wp-mail[.]net<\/code>.<\/li>\n\n\n<li><strong>La\u017ena core datoteka:<\/strong> <code>wp-includes\/class-wp-cache-util.php<\/code>.<\/li>\n\n\n<li><strong>Sistemski cron:<\/strong> oznaka <code>#ms6v46<\/code>.<\/li>\n\n\n<li><strong>Pravila za izvr\u0161avanje:<\/strong> <code>.htaccess<\/code> pravila koja dopu\u0161taju izvr\u0161avanje <code>.cache<\/code> datoteka kao PHP koda te <code>.cache<\/code> datoteke koje sadr\u017ee PHP.<\/li>\n\n\n<li><strong>Dodatna mjesta za pregled:<\/strong> <code>mu-plugins<\/code>, drugi dodaci, direktoriji <code>inc\/<\/code>, <code>includes\/<\/code> i <code>lib\/<\/code> nestandardnih tema, Rank Math <code>includes\/<\/code> i PHP datoteke u <code>uploads\/<\/code>.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">\u010cistu verziju preuzmite izravno sa svojeg ra\u010duna<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Nakon \u0161to dovr\u0161ite odgovaraju\u0107i postupak oporavka, instalirajte Rank Math PRO <strong>3.0.124<\/strong>. U preglednik izravno upi\u0161ite <code>rankmath.com<\/code>, prijavite se na svoj ra\u010dun i otvorite odjeljak za preuzimanja.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Neki korisnici mo\u017eda \u0107e morati ponovno postaviti lozinku ra\u010duna kako bi se prijavili. Taj postupak pokrenite sa stranice koju ste sami otvorili, a ne preko neo\u010dekivane poruke e-po\u0161te.<\/p>\n\n\n\n<div class=\"wp-block-group callout callout-warning is-style-warning is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Pazite na la\u017ene poruke<\/h4>\n\n\n<p class=\"wp-block-paragraph\">Rank Math ne \u0161alje poveznice za prijavu ni preuzimanje e-po\u0161tom. Neo\u010dekivane poruke koje tra\u017ee da kliknete poveznicu za novu lozinku ili preuzimanje tretirajte kao sumnjive.<\/p>\n\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Neslu\u017ebene stranice koje redistribuiraju dodatke, uklju\u010duju\u0107i takozvane GPL repozitorije, mogu i dalje nuditi kopije verzije 3.0.123. \u010cisti paket zato uvijek preuzmite sa svojeg ra\u010duna kod proizvo\u0111a\u010da.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ako trebate pomo\u0107 oko procjene stanja ili koraka za oporavak, otvorite <a href=\"https:\/\/rankmath.com\/support\/\">zahtjev podr\u0161ci<\/a> ili pi\u0161ite na <code>support@rankmath.com<\/code>. Navedite verziju Rank Math PRO i korake koje ste ve\u0107 dovr\u0161ili kako bi podr\u0161ka mogla procijeniti \u0161to jo\u0161 treba provjeriti.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u0160to promijeniti u odr\u017eavanju WordPress stranica<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Slu\u017ebeni kanal i komercijalna licenca ne isklju\u010duju napad na lanac opskrbe. Automatska a\u017euriranja premium dodataka tako\u0111er imaju dvije strane: brzo donose ispravke, ali mogu brzo distribuirati i kompromitirani slu\u017ebeni paket.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>\u010cuvajte sigurnosne kopije izvan produkcijskog poslu\u017eitelja<\/strong> i zadr\u017eavajte dovoljno prethodnih kopija da mo\u017eete odabrati onu nastalu prije incidenta.<\/li>\n\n\n<li><strong>Pratite i, gdje mo\u017eete, ograni\u010dite odlazne veze web-poslu\u017eitelja.<\/strong> Tako mo\u017eete lak\u0161e uo\u010diti i blokirati komunikaciju sa zlonamjernim domenama.<\/li>\n\n\n<li><strong>Provjeravajte kontrolne zbrojeve corea i dodataka.<\/strong> Za premium dodatke bez dostupnih kontrolnih zbrojeva koristite \u010diste slu\u017ebene pakete za usporedbu.<\/li>\n\n\n<li><strong>Pregledajte pravila za automatska a\u017euriranja premium dodataka<\/strong> zajedno s postupkom kojim otkrivate problem i vra\u0107ate prethodno \u010disto stanje.<\/li>\n\n\n<li><strong>Preuzimajte dodatke sa slu\u017ebenog korisni\u010dkog ra\u010duna<\/strong> i ne vjerujte neo\u010dekivanim porukama koje nude prijavu, novu lozinku ili hitno preuzimanje.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Sada provjerite koje su va\u0161e instalacije preuzele Rank Math PRO u zahva\u0107enom intervalu i je li dodatak bio aktivan. Za potvr\u0111eno zahva\u0107ene stranice odaberite povrat \u010diste kopije ili dovr\u0161ite ru\u010dni postupak pravilnim redoslijedom, zamijenite vjerodajnice i nastavite pratiti instalaciju sljede\u0107ih dana.<\/p>\n\n\n<div class=\"references-section\">\n                <h2>Reference \/ Izvori<\/h2>\n                <ul class=\"references-list\"><li><a href=\"https:\/\/rankmath.com\/kb\/pro-3-0-123-security-incident\/\" target=\"_blank\" rel=\"noopener noreferrer\">Rank Math PRO 3.0.123 Security Incident: How to Secure Your Website<\/a><\/li><li><a href=\"https:\/\/www.wordfence.com\/blog\/2026\/10\/rank-math-seo-pro-3-0-123-malware\/\" target=\"_blank\" rel=\"noopener noreferrer\">Rank Math SEO PRO 3.0.123 malware<\/a><\/li><li><a href=\"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/81cd7a2c-ad0c-4dbc-b5dc-07ec866d5c1f\" target=\"_blank\" rel=\"noopener noreferrer\">Rank Math SEO PRO 3.0.123 &#8211; Unauthenticated Embedded Malicious Code<\/a><\/li><\/ul>\n            <\/div>","protected":false},"excerpt":{"rendered":"<p>Dio slu\u017ebenih paketa Rank Math PRO 3.0.123 sadr\u017eavao je zlonamjerni kod. Ako ste takav paket aktivirali, samo a\u017eurirati dodatak nije dovoljno: morate ukloniti i tragove koje je napada\u010d mogao ostaviti.<\/p>\n","protected":false},"author":44,"featured_media":276,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[151,150,148,10,8],"class_list":["post-277","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sigurnost","tag-napad-na-lanac-opskrbe","tag-rank-math","tag-sigurnost-dodataka","tag-wordpress","tag-wp-cli"],"_links":{"self":[{"href":"https:\/\/helloblog.io\/hr\/wp-json\/wp\/v2\/posts\/277","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/helloblog.io\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/helloblog.io\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/helloblog.io\/hr\/wp-json\/wp\/v2\/users\/44"}],"replies":[{"embeddable":true,"href":"https:\/\/helloblog.io\/hr\/wp-json\/wp\/v2\/comments?post=277"}],"version-history":[{"count":0,"href":"https:\/\/helloblog.io\/hr\/wp-json\/wp\/v2\/posts\/277\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/helloblog.io\/hr\/wp-json\/wp\/v2\/media\/276"}],"wp:attachment":[{"href":"https:\/\/helloblog.io\/hr\/wp-json\/wp\/v2\/media?parent=277"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/helloblog.io\/hr\/wp-json\/wp\/v2\/categories?post=277"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/helloblog.io\/hr\/wp-json\/wp\/v2\/tags?post=277"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}