Rank Math SEO PRO Malware: Supply-Chain Compromise (CVE-2026-111862) and What to Do Now

Rank Math has disclosed that a subset of its Rank Math SEO PRO version 3.0.123 packages contained malware. If you downloaded or updated the plugin between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC and then activated it, your website may be compromised.

In short: this was a supply-chain compromise, not a coding bug. Attackers modified the plugin files served through Rank Math’s own download channel, so the malware arrived inside what looked like a legitimate update. Rank Math pulled the tainted packages and released a clean version 3.0.124. Administrators who activated the affected build are told to treat their sites as fully compromised, restore from a backup made before October 15, and rotate every credential the site could reach.

What Happened

On October 17, 2026, Rank Math published a security advisory confirming that some copies of Rank Math SEO PRO version 3.0.123 shipped with injected malware. The tainted packages were distributed for roughly 11 hours, from 20:02 UTC on October 15 until 07:12 UTC on October 16. The moment the window closed, Rank Math removed the compromised files from its servers and published a clean rebuild as version 3.0.124.

The incident is tracked as CVE-2026-111862 with a CVSS score of 9.8, and security researchers describe it as exploited in the wild. That wording matters: there is no separate proof-of-concept floating around because the malware was embedded directly in the distributed plugin files. Anyone who installed and activated one of the tainted packages during the window executed the payload the moment the plugin was turned on. It is the same playbook behind other supply-chain attacks this month, such as the Tensorlake npm compromise, where the poisoned package itself is the attack.

Rank Math is one of the most widely used SEO ecosystems for WordPress, serving millions of sites across its free plugin and commercial PRO add-on. The free Rank Math SEO plugin is not part of this incident. Only the paid PRO add-on version 3.0.123 is affected, and only the packages fetched inside the 11-hour window.

Am I Affected? How to Tell

Which version you are running is not enough information on its own. Because only a subset of 3.0.123 packages were tainted, you need to match the download time against the breach window.

• You installed and activated 3.0.123 during the window: treat your website as compromised and follow the recovery steps below.
• You installed 3.0.123 but never activated it: delete the plugin files, install clean version 3.0.124 from your Rank Math account, and run a security scan as a precaution.
• You downloaded 3.0.123 but never installed it: there is no indication from this incident alone that your site is compromised.
• You got 3.0.123 outside the window, or you never used PRO: you are not affected by this incident.

Rank Math says its records show which users downloaded the affected packages during the window, and it notified those customers directly. If you received one of those notifications, follow the recovery steps even if you have since changed versions, because the malware may have left persistence behind.

How the Malware Works

According to the vendor advisory and the Wordfence intelligence team’s reporting, the attack follows a familiar but nasty pattern. Here is what the embedded code does once the plugin is activated:

Persistent backdoor access

The malware phones home to a command-and-control domain at rank1cdn.com and establishes persistent access. Worse, it hooks into normal site traffic so that hidden PHP backdoors are recreated whenever someone visits the website. That design choice is deliberate: cleaning up the obvious files without disabling the re-creation mechanism leaves the site infected.

Rogue administrator accounts

The payload creates unauthorized administrator accounts on the site. Rank Math’s advisory says to look for suspicious usernames beginning with wpsupport_ followed by random characters, or accounts using email addresses ending in @wp-mail.net. Any account matching that pattern should be treated as attacker-created.

Fake core files and executable cache files

The malware drops a fake WordPress core file at wp-includes/class-wp-cache-util.php. This is not a legitimate WordPress file, and its presence is a strong sign of compromise. It also plants PHP-executable .cache files and adds .htaccess rules that let those files run as PHP, plus a system cron marker tagged #ms6v46 and malicious database keys in the wp_options table (_uf6qdn2hmm, t8krdk990phb, _np5pvf754c). If the scale of WordPress plugin risk feels abstract, consider that a separate flaw in the Backuply plugin put 600,000 WordPress sites at risk this week, and the Bricksforge flaw is under active exploitation right now.

Credential and secret harvesting

The final stage steals whatever secrets the web server can reach: WordPress user passwords, database credentials from wp-config.php, API keys, payment gateway keys, SMTP credentials, and anything else stored in the site’s settings. This is why Rank Math insists that rotating credentials is essential even if you restore from a backup.

What to Do Right Now

Step 1: Restore from a clean backup if you have one

Rank Math’s recommended option is restoring the website and database from a backup created before October 15 at 20:02 UTC. After restoring, run a scan with a reputable security tool such as Wordfence or Sucuri, change all passwords and credentials, and then install clean version 3.0.124. This is the safest path because it wipes out any persistence the malware may have established before you noticed it.

Step 2: Clean manually if no backup exists

If restoring from a backup is not possible, Rank Math published a detailed manual cleanup sequence. The order matters: stop the malware from rebuilding itself first, then remove the other malicious changes.

First, delete the entire rank-math-pro plugin folder from the server. Deactivating the plugin is not enough. Then remove the malicious wp_options entries listed above, and block outgoing connections to rank1cdn.com if your hosting or firewall supports it.

Next, hunt for the persistence the attacker left behind: suspicious PHP files in wp-content/mu-plugins/, other plugins’ folders, and theme inc/, includes/, and lib/ directories (look for base64_decode combined with XOR loops, the key xmmqhn, proc_open, or PHP-FPM socket code). Review your user list for rogue administrators, delete the fake core file, inspect .htaccess for rules that execute .cache files, and check the system crontab and WP scheduled events for the #ms6v46 marker.

Step 3: Rotate every credential

This step is essential even if you restored from a backup. Regenerate the WordPress security keys and salts in wp-config.php, change the database username and password, and replace API keys, payment gateway keys, SMTP credentials, and hosting, FTP, SFTP, and SSH passwords. Review two-factor authentication on administrator accounts. If you are unsure which credentials need replacing, ask your hosting provider or a security professional to review them with you.

Step 4: Update to 3.0.124 the right way

Once the site is clean, install Rank Math SEO PRO 3.0.124. Download it directly from your Rank Math account at rankmath.com. Rank Math warns that it will never send login or download links by email, so treat any unsolicited email asking you to click a password-reset or download link as suspicious. Attackers routinely piggyback on incidents like this with phishing waves.

Why This Incident Matters Beyond Rank Math

Supply-chain attacks against WordPress plugins are becoming a pattern, not a fluke. Just this year, similar tampering hit licensed update channels for other commercial WordPress plugins, and past incidents included trojanized builds of Gravity Forms and five plugins on WordPress.org itself. The common thread is trust: the malicious code arrives through the channel site owners rely on for security, which makes it far more effective than a phishing email or a drive-by exploit.

There are two practical takeaways. First, for high-value plugins, verify checksums when they are available and keep offline or hosted backups you can actually restore. Second, treat vendor update channels as attack surface: a compromised build server or developer account can turn a routine update into a backdoor. Rank Math’s own advisory acknowledged the incident is getting its full attention and said it is taking steps to reduce the risk of a repeat.

FAQ

Does the Rank Math malware affect the free Rank Math SEO plugin?

No. The incident is limited to Rank Math SEO PRO version 3.0.123 packages distributed during the October 15-16, 2026 window. The free plugin was not compromised.

I have 3.0.123 installed but I downloaded it on October 14. Am I safe?

Yes, according to the vendor. Only packages obtained between October 15 at 20:02 UTC and October 16 at 07:12 UTC contain the malware. Version 3.0.123 fetched outside that window is not affected, but updating to 3.0.124 is still a good idea.

Will updating to 3.0.124 remove the malware?

Updating the plugin replaces the trojanized files, but it will not remove backdoors, rogue accounts, or stolen credentials the malware already created. If you activated an affected package, you need to follow the full cleanup and credential-rotation steps, not just update.

What does CVE-2026-111862 mean for me?

It is the identifier assigned to this supply-chain compromise, rated 9.8 out of 10 (Critical). Practically, it is the label to search for when checking whether your security tools and vulnerability scanners have detection coverage for this incident.

How can I tell if my site already sent data to the attackers?

You cannot reliably tell from the site alone, which is exactly why Rank Math says to assume exposure. The malware was designed to harvest credentials and server secrets, so rotating everything is the safe assumption rather than trying to prove whether exfiltration succeeded.