Vulnerabilities & Exploits · Supply Chain

Rank Math PRO backdoor outlives the plugin

Rank Math said some copies of Rank Math PRO 3.0.123 distributed through its official download and update channel during an 11-hour window—from 20:02 UTC October 15 to 07:12 UTC October 16, 2026—contained malware that could compromise sites if activated. The company removed the files and released clean version 3.0.124; the displayed version number alone does not show whether a download fell in the affected window.

Rank Math says the malware can recreate a hidden backdoor whenever someone visits an infected site. Wordfence says upgrading replaces the plugin but may leave files, administrator accounts, and scheduled tasks elsewhere on the server. Because the web-server account may write beyond the WordPress installation, access can persist outside the plugin folder.

The official distribution channel and clean release are not proof that an activated site is clean. Where the web-server account can write outside WordPress, persistence may extend to other locations—and potentially to other sites sharing that account.

3 sources · 17h ago

CVE-2026-111862

NVD KEV

CVSS 9.8 CRITICAL: rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages…

Timeline

Oct 19 Reported by BleepingComputer

Sources

Oct 19 BleepingComputer
WordPress SEO plugin Rank Math compromised to backdoor websites
Some downloads of the Rank Math PRO WordPress plugin from the vendor's official website carried malware that planted hidden backdoors in a supply-chain attack last week.
original
Oct 19 The Hacker News
Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor
Rank Math PRO distributed malware for 11 hours, exposing WordPress sites that activated affected builds to persistent backdoors.
original
Oct 19 SecurityWeek
Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack
Hackers injected malware into Rank Math PRO version 3.0.123 packages distributed between October 15 and October 16.
original

Part of the PlainSec briefing for 2026-10-20

Every edition of this story: Rank Math PRO backdoor outlives the plugin

More from today

Vulnerabilities & Exploits · Supply ChainRank Math PRO backdoor outlives the pluginRank Math said some copies of Rank Math PRO 3.0.123 distributed through its official download and update channel during an 11-hour window—from 20:02 UTC October 15 to 07:12 UTC October 16, 2026—contained malware that could compromise sites if activated. The company removed the files and released clean version 3.0.124; the displayed version number alone does not show whether a download fell in the affected window.Rank Math says the malware can recreate a hidden backdoor whenever someone visits an infected site. Wordfence says upgrading replaces the plugin but may leave files, administrator accounts, and scheduled tasks elsewhere on the server. Because the web-server account may write beyond the WordPress installation, access can persist outside the plugin folder.The official distribution channel and clean release are not proof that an activated site is clean. Where the web-server account can write outside WordPress, persistence may extend to other locations—and potentially to other sites sharing that account.3 sources · 17h ago

CVE-2026-111862

NVD KEV

CVSS 9.8 CRITICAL: rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages…

Timeline

Oct 19 Reported by BleepingComputer

Sources

Oct 19 BleepingComputer

WordPress SEO plugin Rank Math compromised to backdoor websites

Some downloads of the Rank Math PRO WordPress plugin from the vendor's official website carried malware that planted hidden backdoors in a supply-chain attack last week.

original

Oct 19 The Hacker News

Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor

Rank Math PRO distributed malware for 11 hours, exposing WordPress sites that activated affected builds to persistent backdoors.

original

Oct 19 SecurityWeek

Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack

Hackers injected malware into Rank Math PRO version 3.0.123 packages distributed between October 15 and October 16.

original

Part of the PlainSec briefing for 2026-10-20Every edition of this story: Rank Math PRO backdoor outlives the pluginMore from today

Siemens signed launcher hides a trojanized installer

Plex exploit chain drops miners and proxy software

CISA puts BeyondTrust zero-day on the clock