RankMath Rank Math SEO PRO Plugin 3.0.123 on WordPress backdoor

Summaryinfo

A vulnerability classified as problematic was found in RankMath Rank Math SEO PRO Plugin 3.0.123. This vulnerability affects unknown code. The manipulation results in backdoor. This vulnerability is identified as CVE-2026-111862. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, was found in RankMath Rank Math SEO PRO Plugin 3.0.123. Affected is an unknown function. The manipulation with an unknown input leads to a backdoor vulnerability. CWE is classifying the issue as CWE-912. The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a website if the plugin was activated and directs sites that activated an affected package to treat the website as compromised. The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server. Rank Math identifies three malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker as incident indicators. Only packages obtained during the vendor-confirmed window are claimed as affected; version 3.0.123 alone is not sufficient to establish compromise. Rank Math removed the affected files and released version 3.0.124 as the clean replacement.

The advisory is shared for download at wordfence.com. This vulnerability is traded as CVE-2026-111862 since 10/17/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation needs additional levels of successful authentication. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1588.001.

Upgrading to version 3.0.124 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• RankMath

Name

• Rank Math SEO PRO Plugin

Version

• 3.0.123

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion