A supply-chain breach at Rank Math let malware ride along with Rank Math PRO version 3.0.123 for roughly 11 hours between October 15 and 16, 2026. Anyone who downloaded or auto-updated to that build during the window got a hidden backdoor bundled with their SEO plugin, one that rebuilds itself even after the malicious files are deleted. Rank Math disclosed the incident on October 16 and shipped a clean version, 3.0.124, the same day.
What Got Installed, and When
According to Rank Math’s own security notice, the compromised files were available for download or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16. Only the premium Rank Math PRO plugin was affected. The free Rank Math SEO plugin on WordPress.org was not touched.
Wordfence assigned the incident CVE-2026-111862, rated a critical 9.8, and the NVD entry confirms the same timeline, affected version, and indicators that Rank Math published. That agreement between the vendor and an independent researcher matters here, since none of the details below are resting on one party’s account alone.
Is Your Rank Math PRO Site Affected?
The version number alone won’t tell you anything. What matters is whether your copy of 3.0.123 was installed and activated during that 11-hour window.
- Installed and activated during the window: treat the site as compromised, even if it has since been updated to 3.0.124.
- Installed but never activated: delete the plugin files, install 3.0.124 fresh, and run a scan anyway.
- Downloaded but never installed: Rank Math says this alone doesn’t indicate compromise.
The malware is built to persist. It can recreate its own backdoor file, wp-includes/class-wp-cache-util.php, the moment someone visits the site again, which is why deleting a single file and calling it done doesn’t work here. Rank Math’s indicators also include three oddly named wp_options entries, administrator accounts with usernames starting with wpsupport_, a modified .htaccess file that lets .cache files execute as PHP, and outbound traffic to the domain rank1cdn[.]com.
What to Do About It
If you have a clean backup from before October 15, that’s the fastest path: restore it, run a security scan, rotate every credential the site touches, and only then install 3.0.124.
Without a backup, Rank Math’s own cleanup order matters. Delete the entire plugin folder first, not just the files WordPress shows you under Plugins. Remove the three malicious database entries. Block outbound connections to rank1cdn[.]com if your host allows it. Then hunt for what else got left behind: backdoors tucked into other plugin or theme folders, unfamiliar admin accounts, cron jobs tagged #ms6v46, and SSH keys that weren’t yours to begin with.
Rotate credentials regardless of which path you take. That means WordPress passwords, database credentials, wp-config salts and keys, API keys, hosting and FTP or SSH access, and two-factor settings. The malware was designed to expose anything the server could reach, so it’s safest to assume it did.
It’s also a reminder that plugin security isn’t only about what a changelog catches. It’s about what happens upstream, on a vendor’s own build and distribution systems, before a single line of code on your site ever changes. A WordPress maintenance and security review that checks for exactly these indicators, stray admin accounts, modified core files, scheduled tasks nobody set up, will still catch this even when the plugin itself looks fine on the surface.
This marks the second WordPress plugin update-channel compromise we’ve covered in under three weeks; see our report on the UpdraftCentral key theft from October 19. No public evidence ties the two incidents to the same attackers, but premium plugin update pipelines getting hit twice in a month is a pattern worth watching.
