Rank Math PRO downloads carried a self-restoring backdoor for about 11 hours
Original title: Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor
Copies fetched from rankmath.com between October 15 20:02 UTC and October 16 07:12 UTC can recreate a hidden backdoor; clean release is 3.0.124.
Rank Math said paid Rank Math PRO copies downloaded or delivered as updates during that window contained malware, and any site that installed and activated one should be treated as compromised. The backdoor can return when the site is visited. Installing clean version 3.0.124 replaces the plugin but does not remove files, administrator accounts, or scheduled tasks already placed elsewhere. Wordfence assigned CVE-2026-111862 and scored it 9.8; the free WordPress.org plugin is not named.
Unconfirmed: Rank Math and Wordfence have not named the attacker or published a code analysis, and Rank Math has not said how its systems were compromised.
- Version number alone does not show whether a copy is affected.
- Sites that activated 3.0.123 in the window stay compromised after updating to 3.0.124.
- Cleanup starts by deleting the plugin folder and three named wp_options entries.
- Indicators include rank1cdn[.]com, wpsupport_ admins, and @wp-mail[.]net accounts.
- The free Rank Math SEO plugin, with more than 4 million installs, is not named.
Impact: Self-restoring backdoor; reachable site secrets may be exposed
| Product | Affected | Fixed in |
|---|---|---|
| Rank Math PRO | copies downloaded or updated from rankmath.com between 20:02 UTC October 15 and 07:12 UTC October 16 | 3.0.124 |
- 1.Restore a site and database backup from before 20:02 UTC on October 15, then install 3.0.124.
- 2.Without a backup, delete the rank-math-pro folder and options _uf6qdn2hmm, t8krdk990phb, and _np5pvf754c first.
- 3.Rotate WordPress, database, API, hosting, and SSH credentials and block rank1cdn[.]com.
- CVEs
- CVE-2026-111862
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1505.003 Web ShellT1098 Account ManipulationT1053.005 Scheduled TaskT1098.004 SSH Authorized Keys
- Vendors
- Rank Math
- Products
- Rank Math PRO
- Organizations
- WordfencePatchstack
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111862 | Supply-chain malware in some Rank Math SEO PRO 3.0.123 packages | 9.8 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | group.one | h Has Not Said Rank Math, part of the Swedish hosting group group.one , has not said how the malicious files entered its download |
| domain | rank1cdn.com | t8krdk990phb or _np5pvf754c. Block outgoing connections to rank1cdn[.]com if the hosting provider or firewall allows it. Only then |
| domain | wp-mail.net | inning wpsupport_, or accounts with email addresses ending @wp-mail[.]net. Server : .htaccess rules that let .cache files run as PH |
From the original article
5 min read at thehackernews.com
Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath. com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a security notice published on October 16. Any site that installed and activated one of those copies should be treated as compromised, and the
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.