Rank Math SEO PRO CVE-2026-111862: Version 3.0.123 Shipped With Malware for 11 Hours

This CVE isn't about a coding mistake. CVE-2026-111862, published by NVD on October 19, 2026, describes a supply-chain compromise: some of the packages for Rank Math SEO PRO 3.0.123, the paid edition of one of WordPress's most widely installed SEO plugins, contained malware.

Updating your plugin — the advice everyone gives — is exactly what infected sites during the affected window.

The Vulnerability

The score comes from Wordfence (CNA); NVD hasn't produced its own assessment. The CVE isn't in CISA KEV at the time of writing.

What Happened

According to NVD's description, which relays Rank Math's own statement:

• only packages downloaded or updated during the vendor-confirmed window are affected. Running 3.0.123 is not enough on its own to establish a compromise;
• the affected files contained malware that could compromise the site if the plugin was activated;
• Rank Math tells sites that activated an affected package to treat the website as compromised;
• the vendor removed the affected files and released 3.0.124 as the clean replacement.

NVD doesn't say how the distribution channel was compromised. The details are on Rank Math's incident page listed in the references (rankmath.com/kb/pro-3-0-123-security-incident/).

What the Malware Does

Per the description, it may:

• establish persistent access;
• talk to the domain rank1cdn[.]com (a name that misleadingly suggests a vendor CDN);
• recreate hidden backdoors on page visits;
• expose WordPress credentials, database credentials, API keys and any other secret the web server can read.

The third point is the one that matters for cleanup: a backdoor that rebuilds itself on every visit survives deleting any single file, and will likely survive a plain update to 3.0.124 too. That's an inference, but it's exactly why the vendor talks about a compromised site rather than a plugin to swap out.

Indicators of Compromise

According to NVD, Rank Math lists these indicators:

Note the system cron marker: the malware doesn't stop at WordPress. It acts on the host, with the web server user's privileges.

Who Is Affected

1. You run Rank Math SEO PRO (the free edition isn't named in the CVE);
2. the plugin was downloaded or updated between October 15, 20:02 UTC and October 16, 07:12 UTC;
3. it was activated.

For sites in Europe and Asia, much of that window falls overnight, when an automatic update can land without anyone noticing. Check each site's update logs rather than assuming.

What to Do

If the site didn't receive a package during the window

Update to 3.0.124 and still check for the indicators above.

If the site activated a package from the window

Follow the vendor's guidance: the site is compromised.

1. Isolate it: maintenance mode, or block inbound traffic while you clean up.
2. Restore from a backup taken before October 15 if you can, then install 3.0.124. File-by-file cleanup is risky against malware that rebuilds itself.
3. Remove unknown admin accounts, the wp_options keys flagged by the vendor, and the system cron entry.
4. Rotate every secret: WordPress account passwords, the database password, the keys and salts in wp-config.php, and API keys stored in plugin settings (SMTP, payments, CRM…).
5. Block rank1cdn[.]com outbound and watch for connection attempts.
6. Check the host: on shared or multi-site hosting, a system cron means checking every other site running as the same user.

For the other critical WordPress plugin flaws this week, see LearnPress and LatePoint.

Why Continuous Monitoring of Your WordPress Plugins Matters

A supply-chain compromise flips the usual rule: it isn't the old version that's dangerous, it's one specific update over a window of a few hours. To respond, you need to know right away which sites run the plugin, and at which version.

With cveo.tech, inventory your WordPress plugins with their versions and get an alert as soon as a critical CVE hits them.