Attackers modified distribution files for Rank Math SEO PRO 3.0.123, turning a routine WordPress plugin update into a backdoor that steals credentials. The compromise, tracked as CVE-2026-111862 with a CVSS score of 9.8, affected packages downloaded or updated between 20:02 UTC on October 15 and 07:12 UTC on October 16, and it was publicly reported on October 17.
CVE-2026-111862: Contaminated Rank Math SEO PRO Update Packages
The vulnerability is being exploited in the wild through contaminated update packages. Attackers altered a subset of the 3.0.123 distribution files. Because the malware was embedded in the files themselves, there is no separate proof-of-concept exploit.
The window closed at 07:12 UTC on October 16, when the affected packages were removed and version 3.0.124 was released. Running version 3.0.123 does not by itself mean a site is compromised. Only packages obtained inside the roughly eleven-hour window are affected, and 3.0.124 is clean.
Rank Math’s ecosystem has more than four million users, according to the reporting, though PRO install counts are not public. The number of sites that took the tainted package is therefore unknown.
What the Malware Does After an Administrator Activates the Plugin
The damage begins when an administrator activates the trojanized plugin. Wordfence and vendor disclosures describe the malware contacting its command-and-control domain, rank1cdn[.]com, and then taking several persistence steps:
- Hooking site traffic to recreate hidden PHP backdoors.
- Creating unauthorized administrator accounts.
- Planting a fake WordPress core file.
- Dropping PHP-executable .cache files.
- Registering a system cron marker.
The malware also harvests WordPress credentials, database passwords and API keys. That secret theft means a compromised site is not the only exposure: any service reachable with those database passwords or API keys is also at risk.
Remediation: Upgrade, Audit and Rotate Secrets
Sites that activated an affected package should be treated as fully compromised, including exposure of server secrets. Upgrading to 3.0.124 is necessary but does not on its own remove the persistence the malware created, because the backdoors, rogue accounts and cron marker live outside the plugin files.
The recommended response has four parts:
- Upgrade to Rank Math SEO PRO 3.0.124.
- Audit for three malicious wp_options keys, rogue administrator accounts, unexpected .cache files and unauthorized changes.
- Rotate WordPress credentials, database passwords and API keys.
- Review the site for the fake WordPress core file the malware plants.
Why Update-Channel Compromises Are Hard for Site Owners to Detect
A trojanized update differs from a typical plugin vulnerability. The site owner does nothing unusual: the update arrives through the normal channel, and administrators who keep plugins current, which is standard advice, are the ones exposed. Only the narrow timing window decides who is affected.
That timing is the main triage question. Administrators should determine when each site’s copy of 3.0.123 was downloaded or updated and compare it against the 20:02 UTC to 07:12 UTC window. Sites that took the update outside it are not affected by this compromise, while sites inside it should assume the credentials listed above are in attacker hands.
Open Questions About the Rank Math Compromise
The reporting does not explain how the attackers gained the ability to alter the distribution files, and it does not give a count of affected sites. Those details determine whether this was a one-time tampering of a single release or a broader weakness in how the vendor builds and signs packages. Until Rank Math or Wordfence publishes more, site owners have the indicators and timing window above to work from, and the practical priority is to clear persistence and rotate secrets rather than rely on the version bump alone.
