Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor

Rank Math has confirmed that copies of its paid Rank Math PRO SEO plugin for WordPress, distributed from rankmath.com or pushed as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16, were tampered with to include malware. Any site that installed and activated that build should be considered breached, since the malicious code can rebuild its backdoor automatically each time the site is visited, and simply upgrading to the clean 3.0.124 release does not remove rogue admin accounts, scheduled tasks, or other changes already planted on the server. Wordfence has tracked the issue as CVE-2026-111862 with a severity score of 9.8, and alongside Rank Math's own advisory has published detailed manual-removal steps for site owners without a clean pre-incident backup, including deleting the plugin folder, purging specific wp_options entries, blocking a malicious domain, and rotating every credential the site could access. The free Rank Math SEO plugin on WordPress.org is not implicated, and this marks at least the third premium WordPress plugin vendor this year, after Nextend and ShapedPlugin, whose own update infrastructure was abused to ship backdoored code to customers.