CVE-2026-111862: Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code
Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a website if the plugin was activated and directs sites that activated an affected package to treat the website as compromised. The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server. Rank Math identifies three malicious wpoptions keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker as incident indicators. Only packages obtained during the vendor-confirmed window are claimed as affected; version 3.0.123 alone is not sufficient to establish compromise. Rank Math removed the affected files and released version 3.0.124 as the clean replacement.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rank Math SEO PROto a version that resolves this vulnerability.Fixed in 3.0.124 - Operational
If the site activated an affected package downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC, treat the website as compromised.
Event History
Frequently Asked Questions
Which installations should be treated as compromised?
Treat a site as compromised if it activated a Rank Math SEO PRO 3.0.123 package that was downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Having version 3.0.123 alone does not establish compromise if the package was obtained outside that vendor-confirmed window.
Does an attacker need WordPress access or user interaction to exploit this?
No. The affected packages contained embedded malware, and Rank Math states that a website could be compromised when the affected plugin was activated. The supplied severity vector indicates network exploitation with no privileges or user interaction required.
What indicators should responders look for?
Check for the three malicious wp_options keys identified by Rank Math, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker. Also investigate communications with rank1cdn[.]com and backdoors that reappear after page visits.
What should be done if an affected package was activated?
Treat the website as compromised rather than only updating the plugin. Update to the clean 3.0.124 replacement and investigate for persistence and exposed secrets, including WordPress credentials, database credentials, API keys, and other credentials accessible to the web server.