PSA: Malware Found in Some Rank Math SEO PRO 3.0.123 Downloads
Some Rank Math SEO PRO 3.0.123 downloads included malware that can backdoor WordPress sites and steal credentials.
Wordfence reports that Rank Math found malware in some Rank Math SEO PRO 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. The issue is tracked as CVE-2026-111862 with CVSS 9.8. If activated, the code can recreate hidden PHP backdoors, add administrator accounts and cron jobs, contact rank1cdn[.]com, and expose WordPress, database, and API credentials. Rank Math pulled the files and shipped clean version 3.0.124; updating alone does not remove an existing compromise.
80