Rank Math SEO PRO 3.0.123 - Supply-Chain Malware (CVE-2026-111862)

A subset of Rank Math SEO PRO 3.0.123 packages contained supply-chain malware. Check the affected window, IOCs, and recovery steps for CVE-2026-111862.

A subset of Rank Math SEO PRO 3.0.123 packages distributed between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC contained malware. The affected supply-chain package is tracked as CVE-2026-111862 with a critical CVSS score of 9.8. Rank Math replaced it with clean version 3.0.124.

Table of Contents

Incident summary

Product: Rank Math SEO PRO
Plugin slug: seo-by-rank-math-pro
Affected package: version 3.0.123 downloaded or updated during the vendor-confirmed window
Clean replacement: version 3.0.124
CVE: CVE-2026-111862
Severity: Critical, CVSS 9.8
Authentication required: No
Impact: Persistent backdoors, credential theft, unauthorized administrators, scheduled tasks, and full site compromise

Who should treat the site as compromised

Version 3.0.123 alone does not prove compromise. Rank Math states that the incident affected only packages obtained during the specified distribution window. A site where an affected copy was activated should be treated as compromised. If the package was installed but never activated, delete it, install 3.0.124 from the Rank Math account, and scan the site. A package that was downloaded but never installed does not indicate website compromise by itself.

How the malware persists

According to Rank Math and Wordfence, the malicious package can contact rank1cdn[.]com, create hidden PHP backdoors, add unauthorized administrators, alter server rules so files with a .cache extension execute as PHP, and add scheduled tasks. The persistence mechanism may recreate removed files when the website receives a request, so simply updating the plugin is not sufficient after activation.

Immediate remediation

If an affected copy was activated, isolate the site and restore both files and database from a clean backup created before October 15, 2026 at 20:02 UTC when possible.
Before removing secondary artifacts, delete the entire rank-math-pro directory, remove the three malicious options listed below, and block outbound traffic to rank1cdn[.]com. Deactivation alone is insufficient.
Install clean Rank Math SEO PRO 3.0.124 directly from the vendor account after recovery.
Rotate WordPress passwords, database credentials, WordPress salts, hosting and SSH/SFTP credentials, SMTP and payment credentials, and other secrets accessible to the web server.
Reinstall WordPress core, plugins, and themes from trusted sources where appropriate, then scan the complete account and monitor for returning files or outbound connections.

Indicators of compromise

WordPress options named _uf6qdn2hmm, t8krdk990phb, or _np5pvf754c
Outbound connections to rank1cdn[.]com
Administrator usernames beginning with wpsupport_ or accounts using @wp-mail[.]net
The fake core file wp-includes/class-wp-cache-util.php
Unexpected PHP files in mu-plugins, uploads, plugin directories, or non-default theme inc, includes, and lib folders
.htaccess rules that execute .cache files as PHP, or PHP code stored in .cache files
System cron entries containing #ms6v46
Suspicious PHP containing base64_decode with XOR loops, xmmqhn, proc_open, or PHP-FPM socket code

Safe verification commands

wp plugin get seo-by-rank-math-pro --fields=name,status,version
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
wp option get _uf6qdn2hmm
wp option get t8krdk990phb
wp option get _np5pvf754c
wp cron event list
wp core verify-checksums
wp plugin verify-checksums --all
find wp-content/uploads wp-content/mu-plugins -type f -name '*.php' -print
find . -type f -name '*.cache' -print

Premium-plugin checksums may be unavailable. Compare Rank Math PRO files against a fresh 3.0.124 archive downloaded directly from Rank Math. The absence of listed indicators does not prove the server is clean.

Rank Math SEO PRO 3.0.123 – Supply-Chain Malware (CVE-2026-111862)