---
title: 'Malware found in some Rank Math SEO PRO 3.0.123 downloads in supply-chain compromise'
url: 'https://securteksecurity.com/news/rank-math-seo-pro-30123-downloads-malware-supply-chain'
markdown: 'https://securteksecurity.com/news/rank-math-seo-pro-30123-downloads-malware-supply-chain.md'
date: '2026-10-16'
description: 'Some copies of the Rank Math SEO PRO plugin for WordPress, version 3.0.123, that were downloaded or updated between October 15, 2026 at 20:02 UTC and October 16 at 07:12 UTC contained malware, tracked as CVE-2026-111862 with a CVSS score of 9.8. When an affected copy is activated, the malware estab…'
taxonomy:
  category:
    - Cybersecurity
---

# [Malware found in some Rank Math SEO PRO 3.0.123 downloads in supply-chain compromise](https://securteksecurity.com/news/rank-math-seo-pro-30123-downloads-malware-supply-chain)

   16th Oct 2026  

Some copies of the Rank Math SEO PRO plugin for WordPress, version 3.0.123, that were downloaded or updated between October 15, 2026 at 20:02 UTC and October 16 at 07:12 UTC contained malware, tracked as CVE-2026-111862 with a CVSS score of 9.8. When an affected copy is activated, the malware establishes persistent backdoors that can recreate themselves during normal page visits, creates unauthorized administrator accounts, plants a fake WordPress core file, and harvests WordPress credentials, database passwords, API keys, and other secrets accessible to the server, communicating with the domain rank1cdn\[.\]com.

Rank Math removed the affected files and released version 3.0.124 as a clean replacement. The company directs anyone who installed and activated the affected build during the window to treat the website as fully compromised: restore from a backup made before the window where possible, remove the malicious database entries, accounts, and files it lists, and rotate all passwords and credentials.

Sources: [Rank Math](https://rankmath.com/kb/pro-3-0-123-security-incident/); [SecurityOnline](https://securityonline.info/rank-math-seo-pro-compromise-exploited/) (reporting Wordfence)

---

## Navigation

- Parent: [News](https://securteksecurity.com/news.md)
- Previous: [Rakuten Travel unauthorized access may have exposed up to 2.6 million records](https://securteksecurity.com/news/rakuten-travel-unauthorized-access-up-to-2-6-million-records.md)
- Next: [Ransomware hits IDCF Cloud: four zones unrecoverable, 495 customers affected](https://securteksecurity.com/news/ransomware-hits-idcf-cloud-four-zones-unrecoverable-495-customers-affected.md)