CVE-2026-111862
Received Received - Intake

Supply Chain Compromise in Rank Math SEO PRO for WordPress

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Wordfence

Description
Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a website if the plugin was activated and directs sites that activated an affected package to treat the website as compromised. The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server. Rank Math identifies three malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker as incident indicators. Only packages obtained during the vendor-confirmed window are claimed as affected; version 3.0.123 alone is not sufficient to establish compromise. Rank Math removed the affected files and released version 3.0.124 as the clean replacement.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-111862
EUVD
EUVD-2026-104460

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
RankMath Rank Math SEO PRO 3.0.123

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-506 The product contains code that appears to be malicious in nature.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Rank Math SEO PRO for WordPress was affected by a supply-chain compromise in version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. The affected plugin files contained malware that could compromise a website if activated. The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors, and expose sensitive credentials like WordPress credentials, database credentials, and API keys.

Detection Guidance

Check for the presence of malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, fake WordPress core files, PHP-executable .cache files, and a system cron marker as specified by Rank Math. Review plugin files for unauthorized modifications or suspicious activity during the compromised window (October 15, 2026, 20:02 UTC to October 16, 2026, 07:12 UTC).

Scan for network communication with rank1cdn[.]com. Inspect WordPress credentials, database credentials, API keys, and other secrets accessible to the web server for unauthorized exposure.

Impact Analysis

This vulnerability can lead to website compromise, including unauthorized access, data theft, and persistent control by attackers. It may expose sensitive information such as credentials and API keys, allow creation of hidden backdoors, and enable attackers to maintain access even after cleanup attempts. Websites using affected packages during the specified timeframe are at risk.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to potential exposure of personal data and sensitive information. Compromised systems may fail to meet data protection requirements, leading to legal and regulatory penalties. Affected organizations must investigate and remediate to restore compliance.

Mitigation Strategies

Immediately update Rank Math SEO PRO to version 3.0.124 or later. If you used version 3.0.123 during the compromised window, treat the website as compromised and follow incident response procedures.

Remove any malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, fake WordPress core files, PHP-executable .cache files, and system cron markers. Rotate all WordPress credentials, database credentials, API keys, and other exposed secrets.

Block network communication with rank1cdn[.]com. Conduct a full security audit of the website and server to ensure no persistent access or additional backdoors remain.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111862. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart