Rank Math SEO PRO Supply-Chain Compromise Exploited in the Wild via Version 3.0.123
Do Son 
TL;DR
Rank Math SEO PRO for WordPress suffered a critical supply-chain compromise (CVE-2026-111862) that is actively exploited in the wild through trojanized version 3.0.123 packages. Attackers injected malicious code into downloads distributed between October 15 and October 16, 2026. The goal was to plant persistent backdoors and steal server secrets. Site administrators who activated the affected package must update to version 3.0.124 immediately. They should also treat their websites as compromised.
- CVE: CVE-2026-111862 R
- CVSS: 9.8 (Critical · CVSSv3)
- Summary: Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16,…
- Status: Exploited in the wild
- Action: See vendor advisory
Why It Matters
Rank Math is one of the most popular WordPress SEO ecosystems, serving over 4 million users worldwide across its free and premium offerings. While exact active installation counts for the commercial PRO add-on are not publicly disclosed, thousands of business websites rely on Rank Math SEO PRO. These businesses depend on the plugin to manage search visibility.
Tracked as CVE-2026-111862 with a critical 9.8 CVSS score, this flaw is exploited in the wild via contaminated update packages. No separate public proof-of-concept exploit exists because the malware was embedded directly inside the distributed plugin files. Consequently, the vendor directs any administrator who activated an affected package during the breach window to treat their website as fully compromised.
How the Attack Works
According to the Wordfence vulnerability report and vendor disclosures, attackers modified a subset of version 3.0.123 distribution files. When an administrator activates the trojanized Rank Math SEO PRO plugin on a WordPress site, the embedded malware executes automatically.
Backdoor Execution and Data Exfiltration
First, the malicious code establishes persistent access and communicates with an external command-and-control domain at rank1cdn[.]com. Furthermore, the malware hooks into site traffic to recreate hidden PHP backdoors during normal page visits. It also creates unauthorized administrator accounts and plants a fake WordPress core file. Moreover, it drops PHP-executable .cache files and registers a system cron marker. Finally, the payload harvests WordPress credentials, database passwords, API keys, and other sensitive secrets accessible to the web server.
Affected Versions
CVE-2026-111862 affects a specific subset of Rank Math SEO PRO version 3.0.123 packages downloaded or updated between October 15, 2026, at 20:02 UTC and October 16, 2026, at 07:12 UTC. Running version 3.0.123 alone does not confirm a breach if the package was obtained outside that time window. Version 3.0.124 is not affected.
Patch and Mitigation Steps
Rank Math removed the compromised packages from its servers and released version 3.0.124 as a clean replacement. Administrators should upgrade to version 3.0.124 immediately. In addition, defenders who installed or updated the plugin during the affected window must audit their sites for three malicious wp_options database keys, rogue administrator accounts, unexpected .cache files, and unauthorized cron jobs. Also, administrators should rotate all database and API credentials.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
