CVE-2026-111862: CWE-506 Embedded Malicious Code in RankMath Rank Math SEO PRO

CVE-2026-111862 describes a supply-chain compromise in Rank Math SEO PRO WordPress plugin version 3.0.123, where malware was embedded in the plugin packages distributed between October 15, 2026 20:02 UTC and October 16, 2026 07:12 UTC. The malware can establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server. Indicators of compromise include three malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker. The vendor has removed the affected files and released version 3.0.124 as a clean replacement. Only packages obtained during the specified window are affected; simply having version 3.0.123 is not sufficient to confirm compromise.

The malware embedded in the compromised plugin can lead to full website compromise by establishing persistent backdoors, exposing sensitive credentials such as WordPress and database passwords and API keys, and allowing unauthorized administrator access. This can result in complete loss of confidentiality, integrity, and availability of the affected WordPress site.

A clean, patched version 3.0.124 of Rank Math SEO PRO has been released by the vendor, which removes the malicious files. Sites that installed or updated the plugin during the affected window should treat their websites as compromised and perform incident response accordingly. Upgrading to version 3.0.124 or later is strongly recommended. Since this is a supply-chain compromise, verifying the integrity of the plugin installation and removing any indicators of compromise is critical.