CVE-2026-111862 Details

A supply-chain compromise vulnerability has been identified in Rank Math SEO PRO for WordPress, specifically in version 3.0.123. This vulnerability affects users who downloaded or updated the plugin between October 15, 2026, at 20:02 UTC and October 16, 2026, at 07:12 UTC. The compromised version contained malware that could lead to a website being compromised if the plugin was activated. Rank Math has advised users who activated an affected package to treat their website as compromised. The malware could establish persistent access, communicate with rank1cdn.com, recreate hidden backdoors during page visits, and expose various sensitive credentials and secrets accessible to the web server. Indicators of compromise include three malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker. Rank Math has removed the affected files and released version 3.0.124 as a clean replacement.

Users who downloaded or updated to Rank Math SEO PRO v3.0.123 during the affected period should restore their website from a backup created before the incident, run a security scan, change all passwords and credentials, and then install the clean version of Rank Math PRO, v3.0.124. If a backup is not available, the website can be cleaned manually by removing the compromised plugin, deleting malicious database entries, blocking outgoing connections to rank1cdn.com, and checking for other indicators of compromise.