Rank Math SEO PRO 3.0.123 supply-chain compromise (CVE-2026-111862, CVSS 9.8): some copies downloaded 15–16 Oct carried a self-rebuilding WordPress backdoor — install clean 3.0.124 and treat activated sites as compromised
Rank Math, maker of the widely used Rank Math SEO plugin for WordPress, published a security incident notice on 16 October 2026 (UTC) saying that some copies of its paid Rank Math PRO plugin, version 3.0.123, contained malware. Only packages downloaded, or installed through an update, between 20:02 UTC on 15 October and 07:12 UTC on 16 October 2026 are affected (about 4:02 am to 3:12 pm on 16 October in Perth). Having version 3.0.123 does not by itself mean a site was compromised. Rank Math removed the affected files and released a clean version, 3.0.124. Wordfence assigned CVE-2026-111862 and rated it CVSS 9.8; Patchstack lists it as a backdoor, published 17 October. If the plugin was activated, the malicious code could set up persistent access and rebuild a hidden backdoor whenever someone visited the site, so deactivating the plugin is not enough. Rank Math warns that WordPress passwords, database credentials, API keys and other secrets the web server can read should be treated as exposed. Indicators from the notice: outbound connections to rank1cdn[.]com; wp_options entries named _uf6qdn2hmm, t8krdk990phb or _np5pvf754c; administrator accounts whose usernames start with wpsupport_ or that use @wp-mail[.]net email addresses; PHP files in the inc/, includes/ or lib/ folders of non-default themes containing base64_decode with XOR loops, the key xmmqhn, proc_open or PHP-FPM socket code; a fake WordPress core file; .htaccess rules that make .cache files run as PHP; and a web-server-user crontab entry tagged #ms6v46. Rank Math has not said how its distribution was tampered with or how many sites received the affected package. The free Rank Math SEO plugin on WordPress.org is not named in the notice.
- Product
- Rank Math SEO PRO (rank-math-pro) premium plugin for WordPress
- Versions
- Affected: a subset of Rank Math PRO 3.0.123 packages downloaded or updated between 15 Oct 2026 20:02 UTC and 16 Oct 2026 07:12 UTC. Clean: 3.0.124.
- CVSS
- 9.8 Critical (CVSS 3.1, Wordfence)
- Exploited in Australia?
- unknown
- Patch to
- Check when 3.0.123 was obtained. If it was installed and activated in the window: restore files and database from a backup made before 15 Oct 2026 20:02 UTC, scan, rotate every secret the site could reach (WordPress passwords, database credentials, keys and salts, payment, SMTP and API keys, hosting, SFTP and SSH credentials) and review admin two-factor, then install 3.0.124 from your Rank Math account. With no clean backup, first delete the whole rank-math-pro folder and the three wp_options entries and block rank1cdn[.]com, then hunt for the other indicators, rogue admins, cron jobs and changes outside the web root, or hand it to your host or an incident responder. Installed but never activated: delete the files, install 3.0.124 and scan.
Primary: Rank Math — PRO 3.0.123 security incident: how to secure your website (16 Oct 2026, updated 17 Oct) · Vendor: Rank Math — PRO changelog (v3.0.124 clean release, 16 Oct 2026) · CVE: CVE-2026-111862 · Wordfence — PSA: malware found in some Rank Math SEO PRO 3.0.123 downloads (CVE-2026-111862, 17 Oct 2026)