CVE-2026-111862 is not the usual WordPress plugin bug. A limited set of official Rank Math SEO PRO 3.0.123 packages contained malware after Rank Math’s PRO distribution channel was compromised. The affected downloads and updates were delivered from October 15, 2026, 20:02 UTC until October 16, 2026, 07:12 UTC; Rank Math says activating one could compromise the website.
Rank Math SEO is a WordPress plugin used to manage search metadata, Schema markup, XML sitemaps, redirects and related SEO work. The affected component is its commercial PRO extension, often used by site owners, WooCommerce stores, businesses and agencies managing client WordPress estates. The vendor says the free Rank Math SEO plugin from WordPress.org was not affected. A site running 3.0.123 is therefore not automatically compromised: teams need to establish whether that specific PRO package was acquired during the narrow delivery window and activated.
The package, not a crafted request, supplied the access
The malicious code was already inside affected packages, so an attacker did not need a victim to expose an endpoint, visit a page, or enter credentials. Once an administrator installed and activated a tainted PRO build, the code could run with the web server’s access to WordPress and its available secrets.
Rank Math says the malware could create persistent access, call out to rank1cdn[.]com, recreate hidden backdoors during page visits, and expose WordPress credentials, database credentials, API keys and other secrets the server could read. Its incident guidance identifies suspicious wp_options persistence entries, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files and a system cron marker. Those indicators make this an incident-response problem, not simply a version-management task.
Rank Math has not published a root-cause explanation, the number of affected downloads, or a count of compromised sites. Nor is there a verified public patch diff or vulnerable source pattern: remediation was removal of the injected material and release of a clean package.
Update to 3.0.124, then recover the site
Rank Math released 3.0.124 on October 16 as the clean replacement. But installing it only replaces the plugin files; it cannot reliably remove persistence or credentials exposed by an already activated malicious package. The vendor’s preferred response is to restore both site files and the database from a backup made before October 15, 20:02 UTC, rotate passwords and secrets, scan the environment, then install 3.0.124.
Where a known-good restoration is unavailable, remove the entire rank-math-pro directory and the malware’s database persistence before hunting for added files, accounts and scheduled tasks. Treat WordPress administrator users, database users, API credentials and deployment secrets as potentially exposed. Merely deactivating the plugin, or updating in place, is insufficient.
Distribution was confirmed; follow-on abuse was not
Malicious packages reached users through an official channel, which is confirmed supply-chain compromise. Public evidence does not establish that attackers subsequently operated the planted backdoors against named victims; the CVE record’s exploitation field says none, and CVE-2026-111862 is absent from CISA’s Known Exploited Vulnerabilities catalogue as of the available October 21 catalogue version. No public proof of concept or CVE-specific exploit code has surfaced; the advisory record lists no known source code.
In practice, preserve package and access evidence if possible, but prioritize containment and credential rotation. Teams tracking large WordPress fleets can use SecAlerts to monitor their actual software stack and alert on new vulnerabilities affecting the products they run.
