For about 11 hours last week, the update channel for one of WordPress's best-known SEO tools sent out malware. Rank Math says copies of its paid PRO plugin, version 3.0.123, that were downloaded or updated between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026 contained malicious code. That code could compromise a site once the plugin was activated.

The company has released a clean build, PRO 3.0.124. Its advice is blunt, though: if the bad copy was activated on your site during that window, updating does not make the site safe. You should treat the site as compromised.

The free Rank Math SEO plugin distributed through WordPress.org is not affected, according to the vendor.

What happened

This was a supply-chain compromise. Attackers did not break into individual websites. They poisoned the software those websites trusted and installed on their own. The National Vulnerability Database record for CVE-2026-111862 describes a compromise of "a subset" of 3.0.123 packages delivered during the window. Wordfence is the source of the record, and NVD published it on October 19.

The record scores the issue 9.8 out of 10 (Critical) on CVSS v3.1, the industry-standard severity scale. The vector is network-based, with no credentials and no user interaction required. It is classified under CWE-506, the weakness category for embedded malicious code. In other words, this is not a coding mistake an attacker found and exploited. Someone put hostile code into the product. The NVD entry is currently marked "Deferred."

According to The Hacker News, Wordfence assigned the CVE and published an advisory on October 17. Patchstack, another WordPress security firm, classifies the issue as a backdoor. Patchstack also says that because the attack was on Rank Math's own systems, "a rule is not possible for mitigation," meaning a firewall-style virtual patch cannot block it.

Neither Rank Math's notice nor Wordfence names a threat actor. The Hacker News reports that neither one publishes an analysis of the malicious code either. Rank Math has not publicly said how its distribution was compromised.

What the malware does

The NVD description is the most compact public account so far, and it describes malware built to stay on a site. According to the record, the malicious code may:

  • establish persistent access to the site;
  • contact the domain rank1cdn[.]com;
  • recreate hidden backdoors on page visits, so deleting one copy does not get rid of it;
  • expose WordPress credentials, database credentials, API keys and other secrets accessible to the web server.

The self-restoring behaviour is the reason simply updating the plugin is not enough. According to The Hacker News, citing Wordfence, installing 3.0.124 replaces the plugin but does not remove files, administrator accounts or scheduled tasks the malware may already have placed elsewhere on the server.

NVD lists these indicators of compromise:

  • three malicious entries in the WordPress wp_options database table;
  • hidden PHP backdoor files;
  • unauthorized administrator accounts;
  • a fake WordPress core file;
  • .cache files that can execute as PHP;
  • a system cron marker, meaning a scheduled-task artifact at the server level and not just inside WordPress.

Why the version number won't tell you

The obvious first check is "am I on 3.0.123?" That answer alone is misleading. The Hacker News points out that Rank Math's changelog dates version 3.0.123 to October 7, more than a week before the malicious window opened, and that a copy obtained before 20:02 UTC on October 15 is outside the incident. The NVD record states that version 3.0.123 alone "is not sufficient to establish compromise."

What matters is when the copy was obtained, and whether it was activated. Rank Math has not said whether automatic updates delivered the bad package, so check update logs for any PRO site that downloaded or updated during the window, including overnight on October 15-16.

Scale

Rank Math has not said how many PRO sites pulled the bad package. NVD describes only "a subset" of 3.0.123 packages, and Rank Math's notice speaks of a limited number of users. For context, The Hacker News reports that the free plugin lists more than 4 million active installs. That figure covers the unaffected free edition, not the paid PRO edition, and should not be read as the number of exposed sites. The free plugin was last updated on October 6, before the incident window.

What It Means for Defenders

Who is affected: sites running Rank Math PRO that downloaded or updated to 3.0.123 between 20:02 UTC October 15 and 07:12 UTC October 16, 2026. Sites using only the free WordPress.org plugin are not affected, per Rank Math. Agencies and hosts that manage many client sites should check update and download records for every PRO installation, not only the ones they remember touching.

Rank Math's notice sorts sites into three cases:

  • Activated during the window: treat the site as compromised. The vendor's recommended recovery is to restore from a backup taken before 20:02 UTC on October 15, scan the site, change every password, database credential and API key, and only then install PRO 3.0.124.
  • Installed but never activated: delete the plugin files, install 3.0.124, and scan the site.
  • Downloaded only, never installed or activated: Rank Math says there is no indication from the incident alone that the site was compromised. If you are unsure what was installed, contact Rank Math support.

Deactivating is not enough. Rank Math says to delete the rank-math-pro folder entirely. Because the malware can plant backdoors and accounts outside that folder, a clean plugin reinstall on a compromised site leaves those in place. A known-good backup is the vendor's recommended route.

Hunt for the indicators. If you can't restore, or want to confirm a site is clean, look for what NVD describes: administrator accounts you don't recognise, unfamiliar entries in wp_options, PHP files where they don't belong (including .cache files that execute as PHP), anything posing as a WordPress core file that doesn't match the official release, and server-level cron entries you didn't create. Rank Math's notice lists the specific values to look for. Wordfence cautions that the absence of these indicators does not by itself prove a site is clean.

Rotate everything the site could see. The malware may expose WordPress logins, database credentials and API keys. Treat any secret stored in wp-config.php or in plugin settings as exposed. That includes payment-gateway keys, SMTP credentials and third-party service tokens. Rank Math says to do this even after restoring from a backup.

Block the callback domain. Rank Math's notice says to block outgoing connections to rank1cdn[.]com if your host or firewall supports it. Hosts with outbound logging may also want to search past logs for connections to it; a hit would warrant immediate investigation of that site.

For CMMC and federal-contractor shops: if a WordPress site that handles contract-related information, or shares credentials with internal systems, ran the bad build, treat it as a security incident rather than routine patching. Document the timeline, the systems affected and the credentials rotated, and follow your incident-response and reporting obligations.

The bigger lesson

This incident shows a risk of vendor-delivered updates: when the vendor's own distribution channel is the breach point, a trusted update path can carry malware to customer sites. Patchstack's point that no mitigation rule is possible is worth noting. In a case like this, a backup taken from before the window, egress controls, and knowing what normal looks like on your server are among the few defenses a site owner controls.

Sources