Malware found in some Rank Math SEO PRO 3.0.123 downloads in supply-chain compromise

Some copies of the Rank Math SEO PRO plugin for WordPress, version 3.0.123, that were downloaded or updated between October 15, 2026 at 20:02 UTC and October 16 at 07:12 UTC contained malware, tracked as CVE-2026-111862 with a CVSS score of 9.8. When an affected copy is activated, the malware establishes persistent backdoors that can recreate themselves during normal page visits, creates unauthorized administrator accounts, plants a fake WordPress core file, and harvests WordPress credentials, database passwords, API keys, and other secrets accessible to the server, communicating with the domain rank1cdn[.]com.

Rank Math removed the affected files and released version 3.0.124 as a clean replacement. The company directs anyone who installed and activated the affected build during the window to treat the website as fully compromised: restore from a backup made before the window where possible, remove the malicious database entries, accounts, and files it lists, and rotate all passwords and credentials.

Sources: Rank Math; SecurityOnline (reporting Wordfence)