Act nowDisclosed

Advisory · CVE-2026-111862

Rank Math SEO PRO 3.0.123 packages in an 11-hour window shipped with malware

A subset of Rank Math SEO PRO 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC contained malware that can persist on a WordPress site and expose its credentials and secrets. CVSS 3.1 9.8.

Advisory published October 19, 2026Independent summary
Vendor
Rank Math
Product
Rank Math SEO PRO
Identifier / CWE
CVE-2026-111862
CWE-506
Action timing
Immediate
ELI5

Explain it like I’m five

For about eleven hours, the genuine update package itself carried malware, so sites that did everything right and updated promptly were the ones infected.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Tainted package served

    Rank Math SEO PRO 3.0.123 packages obtained between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC contained malware.

  2. 02Plugin activated

    A site that activated an affected package runs the malicious code with the site's own privileges.

  3. 03Persistence planted

    The malware can recreate hidden backdoors on page visits, add unauthorized administrator accounts, and contact rank1cdn[.]com.

  4. 04Secrets exposed

    WordPress credentials, database credentials, API keys, and other secrets reachable by the web server may be exposed.

What happened

Rank Math states that a subset of Rank Math SEO PRO 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC contained malware (CWE-506), and directs any site that activated an affected package to treat the website as compromised. Version 3.0.123 alone does not establish compromise; only packages obtained in that window are claimed as affected. The free Rank Math SEO plugin from WordPress.org is not affected, per the vendor.

Rank Math identifies three malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker as incident indicators. The vendor removed the affected files and released 3.0.124 as the clean replacement.

What to do

  1. Establish whether any site downloaded or updated to Rank Math SEO PRO 3.0.123 inside the October 15 to 16 window, from update logs, host records, or the vendor notification email.
  2. If an affected package was activated, treat the site as compromised: restore from a backup taken before the window where possible, or follow the vendor manual cleanup in order, because the malware recreates its backdoor on page visits.
  3. Check for the vendor indicators: the named wp_options keys, hidden PHP backdoors, wpsupport_ administrator accounts, the fake wp-includes cache file, PHP-executable .cache files, and the tagged cron entry. Block rank1cdn[.]com outbound where you can.
  4. Install the clean 3.0.124 release from your Rank Math account after cleanup.
  5. Rotate WordPress, database, hosting, and API credentials and regenerate wp-config.php salts, whether or not you restored from backup.
  6. Run a full security scan, verify WordPress core checksums, and monitor for reappearing files over the following days.

Management note

This is a vendor supply-chain compromise, not a plugin bug to patch over. A routine update is the infection path, so the response is incident recovery: prove the download window, rebuild trust in the site, and rotate everything the web server could read.