Rank Math SEO PRO 3.0.123: malware in some copies, critical CVE-2026-111862

Rank Math has announced that certain copies of Rank Math SEO PRO version 3.0.123 contained malware. WordPress site operators running this premium plugin must immediately check when it was downloaded or updated, as the exposure window is narrow but the risk—if your installation falls within that timeframe—is complete site compromise.

What happened

According to Rank Math's disclosure, the affected version was downloaded or installed via update between 15 October 2026 at 20:02 UTC and 16 October 2026 at 07:12 UTC. This is not a code vulnerability in the plugin itself, but a supply chain compromise: according to Wordfence's report and vendor communications, attackers modified a subset of files distributed in version 3.0.123.

Wordfence classified the incident as CVE-2026-111862 with a CVSS rating of 9.8 (Critical). The malware could maintain persistent access, recreate hidden backdoors and expose credentials and other secrets accessible to the web server. The domain associated with malware communications, according to Wordfence's findings, is rank1cdn[.]com. A Greek-language report citing Malware News adds an operational detail: the code creates hidden backdoors that recreate themselves on every page visit, even if someone deletes them.

What to do

If an affected copy of version 3.0.123 was active on your site, treat it as compromised: simply updating the plugin is not sufficient, because the malware may have placed additional files, administrator accounts or scheduled tasks elsewhere on the server. Rank Math has removed the compromised files and released version 3.0.124 as a clean replacement.

Don't panic unnecessarily: merely having version 3.0.123 installed does not prove your site is compromised, as Rank Math has limited the incident to users who downloaded or updated to the affected version during the specified window. A helpful note for free plugin users: the free version of the plugin does not appear to be affected.

Anyone uncertain about their installation should verify the update timestamp in the WordPress package manager logs and, if the update occurred within the specified window, proceed with restoration from a backup prior to the incident or complete manual cleanup, followed by rotation of any credentials exposed on the server.