CVE-2026-111862 in Rank Math SEO PRO Plugin
Summary
by MITRE • 10/19/2026
Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a website if the plugin was activated and directs sites that activated an affected package to treat the website as compromised. The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server. Rank Math identifies three malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker as incident indicators. Only packages obtained during the vendor-confirmed window are claimed as affected; version 3.0.123 alone is not sufficient to establish compromise. Rank Math removed the affected files and released version 3.0.124 as the clean replacement.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability described constitutes a severe supply-chain attack targeting the Rank Math SEO PRO plugin for WordPress, specifically affecting versions downloaded or updated within a narrow window between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. This incident represents a compromise of the software distribution pipeline rather than a traditional code flaw in the plugin itself. Attackers successfully injected malicious payloads into specific package builds during this timeframe, resulting in the dissemination of compromised binaries to end-users who updated their installations during that period. The scope is strictly limited to packages obtained within this verified window; possessing version 3.0.123 outside of these dates does not indicate compromise. This distinction is critical for incident response teams conducting forensic analysis, as it prevents unnecessary remediation efforts on unaffected systems while focusing resources on the specific subset of installations that received tainted code.
The technical nature of the malware involves sophisticated persistence mechanisms and data exfiltration capabilities designed to maintain long-term access to compromised WordPress environments. Upon activation by a site administrator, the malicious plugin files establish persistent backdoors that can recreate themselves upon page visits, ensuring resilience against simple file deletion attempts. The payload is configured to communicate with an external command-and-control server located at rank1cdn[.]com, facilitating remote control and data theft. A primary objective of this malware is the harvesting of sensitive credentials stored within the WordPress environment. This includes administrative usernames and passwords, database connection strings containing root or privileged user credentials, API keys for third-party integrations, and other secrets accessible to the web server process. By extracting these assets, attackers can pivot laterally across networks, access backend databases directly, or abuse external service APIs, significantly escalating the impact beyond the initial WordPress installation.
From an operational perspective, this compromise poses a critical risk to website integrity and data confidentiality. The presence of hidden PHP backdoors allows for arbitrary code execution with the privileges of the web server user, effectively granting attackers full control over the hosting environment. Unauthorized administrator accounts created by the malware provide persistent access that survives password changes or plugin deactivations if not thoroughly audited. Additionally, the creation of a fake WordPress core file and PHP-executable .cache files serves to obfuscate the attacker's presence and ensure continued execution even after standard cleanup efforts. The inclusion of a system cron marker suggests an attempt to schedule recurring malicious activities, such as periodic data exfiltration or further malware deployment. Sites that activated any affected package during the specified window must be treated as fully compromised, requiring immediate isolation from external networks to prevent lateral movement and potential exploitation of other internal systems.
To align this incident with established security frameworks, it maps directly to CWE-829, which covers Inclusion of Functionality from Untrusted Control Sphere, highlighting the risk introduced by trusting third-party code without sufficient verification. The attack vector also reflects ATT&CK technique T1505.003, Web Shell: WordPress Plugins and Themes, where attackers leverage legitimate plugin infrastructure to deploy malicious scripts. Furthermore, the persistence mechanisms align with ATT&CK techniques such as T1547.001 (Boot or Logon Autostart Execution) via cron jobs and T1098.002 (Account Manipulation: Additional Cloud Accounts) if administrative access is abused for cloud resource manipulation. The exfiltration of credentials corresponds to ATT&CK technique T1539, Steal Web Session Cookie, although in this context it extends to broader credential harvesting including database and API keys, falling under T1078 (Valid Accounts).
Mitigation requires a multi-layered approach starting with immediate identification. Administrators must audit their WordPress installations for the specific malicious wp_options keys identified by Rank Math as indicators of compromise. A thorough forensic scan is necessary to locate and remove hidden PHP backdoors, fake core files, and unauthorized .cache executables. Simply deactivating or deleting the plugin may be insufficient due to the self-replicating nature of some malware components; manual inspection of file system timestamps and content hashes against known clean versions from before October 15, 2026 is recommended. All administrative passwords must be rotated immediately, along with any database credentials that were exposed. API keys should also be revoked and regenerated to prevent abuse by the attackers who may have already exfiltrated them.
Long-term remediation involves upgrading to version 3.0.124 or later, which has been verified as clean by Rank Math after removing the affected files. However, upgrade alone does not guarantee security if residual malware remains on the server. Implementing strict file integrity monitoring can help detect future unauthorized modifications to plugin directories. Additionally, organizations should review their software supply chain practices, ensuring that updates are sourced only from official repositories and verifying checksums where possible. Security awareness training for administrators is also vital to recognize signs of compromise, such as unexpected redirects or performance degradation, which may indicate the presence of similar supply-chain attacks in other popular plugins. Regular backups taken prior to any update window can facilitate rapid restoration if a comprehensive cleanup proves too complex or risky during active operations.