According to Rank Math, a subset of Rank Math SEO PRO 3.0.123 packages distributed during an 11-hour window on October 15–16, 2026 contained malicious code. The vendor says it may give an attacker persistent access to WordPress sites that activated those packages and expose their credentials and secrets.
What Is It
CVE-2026-111862 is a supply-chain compromise in Rank Math SEO PRO, a WordPress plugin. Some version 3.0.123 packages that were downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC contained malicious plugin files. The weakness is classified as CWE-506 (Embedded Malicious Code).
According to Rank Math, if an affected package was activated, the malware may:
- Establish persistent access to the site
- Communicate with
rank1cdn[.]com - Recreate hidden backdoors when pages are visited
- Expose WordPress credentials, database credentials, API keys, and other secrets the web server can access
Why It Matters
Wordfence gives the issue a CVSS 3.1 base score of 9.8 (Critical) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The malicious code came through the vendor's normal distribution channel, so sites that took a routine update during the window may have installed it. Rank Math says the malware can expose secrets and recreate its own backdoors, so removing the plugin alone may not clean up a site.
Rank Math lists these incident indicators:
- Three malicious
wp_optionskeys - Hidden PHP backdoors
- Unauthorized administrator accounts
- A fake WordPress core file
- PHP-executable
.cachefiles - A system cron marker
As of this writing, the CVE does not appear in the CISA Known Exploited Vulnerabilities catalog. This means KEV does not confirm active exploitation.
What's Vulnerable
- Product: Rank Math SEO PRO for WordPress (vendor: RankMath)
- Affected version: 3.0.123, but only packages obtained during the vendor-confirmed window above
Rank Math says that running version 3.0.123 does not by itself show that a site is compromised. A site is affected only if it obtained and activated a package during the window.
Patch Status
Rank Math removed the affected files and released version 3.0.124 as the clean replacement. Sites that activated an affected package should treat the website as compromised, as the vendor directs. Updating the plugin is not enough. Because the vendor says the malware can expose credentials and secrets, any secrets the web server could access should be considered exposed. The NVD record lists the CVE's status as "Deferred."