CVE-2026-111862

Think of this like a trusted delivery service accidentally sending out a box of tools that had been secretly tampered with — for about 11 hours, anyone who 'picked up' this particular box of the Rank Math SEO plugin installed hidden tools for criminals, not just the SEO features they expected. If you installed or updated during that narrow window, intruders may already have keys to your whole site, including passwords and sensitive data.

This matters to you if you run a WordPress site using the Rank Math SEO PRO plugin and you downloaded, updated, or activated it between October 15, 2026, 20:02 UTC and October 16, 2026, 07:12 UTC. Having version 3.0.123 alone does not mean you're compromised — only installs/activations during that specific window are confirmed affected. Simply activating the plugin in that window is enough to trigger the compromise; no special configuration is required.

Attackers are already actively exploiting this — Rank Math has confirmed real-world compromises tied to this malicious build, not just a theoretical risk. Because the malware creates persistent backdoors and hidden admin accounts, any site that activated the bad package during the window should be treated as breached right now, not just patched. This is a red-alert, act-today situation for anyone in the affected window.

1. Determine exposure by checking plugin update/download logs or your hosting provider's package history for Rank Math SEO PRO installs/updates between 2026-10-15 20:02 UTC and 2026-10-16 07:12 UTC.
2. If exposure is confirmed, do not simply delete or downgrade the plugin — assume full compromise per vendor guidance.
3. Search for Rank Math's published indicators of compromise: three specific malicious wp_options keys, hidden PHP backdoor files, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and an unexpected system cron entry.
4. Rotate all credentials accessible to the web server (WordPress admin/user passwords, database credentials, API keys, third-party integration secrets).
5. Remove persistence mechanisms, including any malicious cron jobs and backdoor files, and consider restoring from a verified clean backup predating the incident window if cleanup confidence is low.
6. Monitor outbound traffic for communication with rank1cdn[.]com as a compromise indicator.
7. Once cleaned, upgrade to the clean release, version 3.0.124.
8. No CISA KEV listing and no public exploit code exist for this CVE as of now, but news sources confirm real-world incidents tied to this malicious build, so treat remediation as urgent regardless of KEV status.

CVSS 9.8 (Critical), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-exploitable with no privileges or user interaction beyond plugin activation, and full compromise of confidentiality, integrity, and availability. Weakness type is CWE-506 (Embedded Malicious Code), a supply-chain compromise rather than a traditional logic flaw. Not listed in CISA KEV, but press reporting confirms real-world exploitation tied to this specific malicious build distributed in a ~11-hour window (2026-10-15 20:02 UTC to 2026-10-16 07:12 UTC); no public exploit code/PoC is tracked separately since the 'exploit' is the malicious package itself. Vendor has removed the affected files and shipped 3.0.124 as the clean replacement; no CVSS-scored patch advisory beyond vendor incident disclosure exists. EPSS prediction is not meaningful here given confirmed exploitation via supply-chain distribution rather than remote exploitation of a code flaw.