Rank Math PRO 3.0.123 packages carried malware in a short window
October 20: Later reports list suspicious options and a fake cache file, and say Rank Math called the impact limited without a site count.
Rank Math says some PRO 3.0.123 downloads from a short October window were malicious; clean 3.0.124 does not remove existing backdoors.
Rank Math says some paid Rank Math PRO 3.0.123 packages downloaded or delivered as updates between October 15, 2026, at 20:02 UTC and October 16 at 07:12 UTC contained malware that can take over a site if activated. The vendor removed the files and released clean 3.0.124; updating replaces the plugin but does not remove backdoors, accounts, or tasks already placed elsewhere. The free WordPress.org plugin is not affected. Wordfence assigned CVE-2026-111862 and scored it 9.8, according to The Hacker News. GBHackers dates the same window to 2023; the other outlets report 2026. Rank Math called the impact limited but gave no count of affected sites.
- Exposure window was October 15, 2026, 20:02 UTC to October 16, 07:12 UTC.
- Clean release is Rank Math PRO 3.0.124; the version number alone is not proof.
- Activated malware may restore a hidden backdoor and expose credentials and secrets.
- Downloads of 3.0.123 that were never activated are not treated as compromised.
- Indicators include rank1cdn.com, wpsupport_ admins, and @wp-mail.net accounts.
- Wordfence scored CVE-2026-111862 at 9.8; the free plugin is not named.
Timeline
dated events in the reporting · oldest first- Oct 15, 2026Malicious Rank Math PRO 3.0.123 packages became available · SecurityWeek
- Oct 16, 2026Vendor exposure window ended at 07:12 UTC · SecurityWeek
What each outlet adds
beyond the shared facts- The Hacker NewsAssigns CVE-2026-111862 at 9.8; free plugin exceeds 4 million installs.
- BleepingComputerVirusTotal PHP sample matched indicators but was not confirmed distributed.
- Cyber Security NewsNames suspicious options and a fake cache file; no victim count.
- SecurityWeekSays malware can run .cache files as PHP through .htaccess.
- GBHackersDates the same download window to 2023 rather than 2026.
- CVEs
- CVE-2026-111862
- Vendors
- Rank Math
- Organizations
- WordfencePatchstack
Coverage
oldest first · one row per article · UTC- · 6d ago
SecurityWeekFirst report
Malicious Rank Math PRO 3.0.123 packages compromise WordPress sites
Packages fetched from October 15, 20:02 UTC to October 16, 07:12 UTC may be infected; 3.0.124 is clean.
- · 6d ago
The Hacker News
Rank Math PRO downloads carried a self-restoring backdoor for about 11 hours
Copies fetched from rankmath.com between October 15 20:02 UTC and October 16 07:12 UTC can recreate a hidden backdoor; clean release is 3.0.124.
- · 6d ago
BleepingComputer
Trojanized Rank Math PRO 3.0.123 planted website backdoors
Only downloads from a roughly 11-hour window were affected; the vendor shipped clean version 3.0.124.
- · 5d ago
Cyber Security News
Malware in Rank Math PRO 3.0.123 installs self-rebuilding backdoors
Only packages downloaded from October 15 at 20:02 UTC to October 16 at 07:12 UTC were tainted; clean release is 3.0.124.
- · 5d ago
GBHackers
Malware shipped in Rank Math PRO 3.0.123; clean build is 3.0.124
Only premium downloads activated between October 15 and 16, 2023, are in scope; the free plugin is unaffected.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111862 | Supply-chain malware in some Rank Math SEO PRO 3.0.123 packages | 9.8 | — |