Rank Math SEO PRO Plugin Vulnerability (CVE-2026-111862)

Security Alert Summary

A supply-chain compromise affected a subset of Rank Math SEO PRO packages associated with version 3.0.123 downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math reports the affected plugin files contained malware that could compromise a site if the plugin was activated. The malware may establish persistent access, communicate with rank1cdn.com, recreate hidden backdoors on page visits, and expose credentials and other secrets. Rank Math removed the affected files and released version 3.0.124 as the clean replacement.

CVE Details

• CVE ID: CVE-2026-111862
• Affected product: Rank Math SEO PRO (vendor: RankMath)
• Affected versions: Packages associated with version 3.0.123 obtained or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Vendor notes that 3.0.123 alone is not sufficient to establish compromise.
• Published: October 19, 2026 at 5:17:04 PM UTC
• Last modified: October 20, 2026 at 3:17:13 PM UTC
• CVSS v3.1 base score: 9.8 (CRITICAL)
• CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Authentication / privileges / user interaction: Privileges Required: NONE; User Interaction: NONE; Attack Vector: NETWORK; Attack Complexity: LOW; Scope: UNCHANGED
• Primary impact: Confidentiality: HIGH; Integrity: HIGH; Availability: HIGH
• CWE / weakness: CWE-506

Technical Details

The issue is a supply-chain compromise affecting a subset of Rank Math SEO PRO packages distributed during the vendor-confirmed window. The compromised packages contained malicious files that, if the plugin was activated, could compromise a website. According to the vendor report, the malware may:

• establish persistent access and recreate hidden backdoors on page visits
• communicate with the domain rank1cdn.com
• expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server

Rank Math identifies several incident indicators found in affected installations: three malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker. Rank Math removed the affected files and released version 3.0.124 as the clean replacement. Only packages obtained during the vendor-confirmed window are claimed as affected.

How This Could Impact Your Website

Consider a typical small site with a site owner, internal staff editors, and an external contractor or contributor. If the site updated or installed an affected package during the confirmed window and the plugin was activated, the malware could create hidden backdoors and unauthorized admin accounts. That could allow persistent access and the exfiltration of secrets accessible to the web server.

Practical consequences include exposure of internal user email addresses and credentials, leaked database or API keys, and an increased risk of targeted phishing or social engineering against staff and contractors. These effects can lead to further account takeover attempts or abuse of external integrations.

If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.

Recommended Actions

• Update the affected plugin to the vendor-released clean version (3.0.124) if you obtained a package during the vendor-confirmed window and have not already applied the replacement.
• Inspect for indicators of compromise listed by the vendor: malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, fake core files, executable .cache files, and unexpected cron markers.
• Review and reduce unnecessary user roles, especially contributor and editor accounts with write access.
• Enforce strong passwords and two-factor authentication for editors and administrators.
• Remove unused or unmaintained plugins and verify plugin sources before installing or updating.
• Monitor site activity and logs for unusual behavior, new admin accounts, or unexpected outbound connections (for example to rank1cdn.com).

If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

• https://rankmath.com/changelog/
• https://rankmath.com/kb/pro-3-0-123-security-incident/
• https://rdap.verisign.com/com/v1/domain/rank1cdn.com
• https://urlscan.io/result/01a145c2-8dc8-72ff-a65d-21209ca29c4f/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/81cd7a2c-ad0c-4dbc-b5dc-07ec866d5c1f?source=cve