RANK Math SEO PRO for WordPress has a critical supply-chain compromise that is being exploited in the wild. Attackers modified a subset of version 3.0.123 distribution files, with contaminated downloads distributed between 15 October 2026 at 20:02 UTC and 16 October 2026 at 07:12 UTC. The flaw is tracked as CVE-2026-111862, and the advisory notes that the malware was embedded directly in the distributed plugin files.
The weaponised package leads to persistent backdoors, data exfiltration and credential theft, with no separate PoC available because the malicious code is contained inside the plugin itself. Vendors have indicated administrators who activated an affected package during the breach window should regard their site as compromised.
Evidence from Wordfence and vendor disclosures describes backdoor execution via embedded malicious code, which establishes persistent access and communicates with a command-and-control domain at rank1cdn[.]com. The malware also recreates hidden PHP backdoors, creates rogue administrator accounts, crafts a fake WordPress core file, drops PHP-executable .cache files, and registers a cron marker.
It is capable of harvesting WordPress credentials, database passwords, API keys and other secrets accessible to the web server. Version 3.0.124 is not affected, and Rank Math has withdrawn the compromised packages and issued the clean update. Administrators are urged to upgrade immediately and audit affected sites for three malicious wp_options keys, rogue admins, unexpected .cache files and unauthorized cron jobs, as well as rotate all database and API credentials. CVSS is listed at 9.8 (Critical, CVSSv3).