Rank Math PRO 3.0.123 malware forces full recovery for activated sites
A malicious build of the premium WordPress SEO plugin Rank Math PRO 3.0.123 was distributed for about 11 hours, from 20:02 UTC on October 15 to 07:12 UTC on October 16, 2026. Tracked as CVE-2026-111862 with a CVSS score of 9.8, the supply-chain compromise requires affected sites to fully restore and rotate all secrets; version 3.0.124 is the clean release.
- Tainted packages went out from 20:02 UTC Oct 15 to 07:12 UTC Oct 16
- CVE-2026-111862 rated 9.8 on CVSS as a supply-chain compromise
- Backdoor contacts rank1cdn[.]com and rebuilds on every page load
- Free plugin unaffected; clean build is version 3.0.124
Read next
Security