CVE-2026-111862: Rank Math SEO PRO supply-chain compromise via malicious update

CVE-2026-111862 · Severity: critical · CVSS 9.8 · Published 2026-10-19

Rank Math SEO PRO, a WordPress plugin that manages website search engine optimization, was compromised during distribution in October 2026. Users who downloaded and activated version 3.0.123 during the affected window received malware that could establish persistent backdoor access, steal credentials and API keys, and communicate with an attacker-controlled server. The vendor released a clean version 3.0.124 and strongly recommends treating affected sites as fully compromised.

Vendors: Rank Math.

Quick answers

Is CVE-2026-111862 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-111862 being exploited in the wild.
How severe is CVE-2026-111862?
Critical severity, with a CVSS score of 9.8, published 19 October 2026.
Which products and versions are affected?
Rank Math SEO PRO 3.0.123 (downloaded or updated between October 15, 2026 20:02 UTC and October 16, 2026 07:12 UTC).
Is there a fix for CVE-2026-111862?
Yes: fixed in 3.0.124. Until then: If you installed and activated the affected version, restore your website and database from a backup created before October 15, 2026 20:02 UTC, then reinstall version 3.0.124. If a clean backup is unavailable, manually remove the plugin folder, delete malicious database entries (option_name values: _uf6qdn2hmm, t8krdk990phb, _np5pvf754c), block outgoing connections to rank1cdn.com, remove hidden backdoor files from wp-content/mu-plugins and theme folders, delete unauthorized administrator accounts and the fake file wp-includes/class-wp-cache-util.php, and remove suspicious .cache files and cron jobs tagged with #ms6v46. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111862 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-111862?
Check whether you run Rank Math SEO PRO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 3.0.124

If you installed and activated the affected version, restore your website and database from a backup created before October 15, 2026 20:02 UTC, then reinstall version 3.0.124. If a clean backup is unavailable, manually remove the plugin folder, delete malicious database entries (option_name values: _uf6qdn2hmm, t8krdk990phb, _np5pvf754c), block outgoing connections to rank1cdn.com, remove hidden backdoor files from wp-content/mu-plugins and theme folders, delete unauthorized administrator accounts and the fake file wp-includes/class-wp-cache-util.php, and remove suspicious .cache files and cron jobs tagged with #ms6v46.

Technical details

A supply-chain compromise affected Rank Math SEO PRO version 3.0.123 packages downloaded between October 15–16, 2026. The malware established persistent access via hidden PHP backdoors, fake WordPress core files, and database markers, then recreated itself on each page visit to prevent removal. Activation of the malicious plugin was required for compromise; the malware exposed WordPress, database, and API credentials to external attacker infrastructure.

Affected products

  • Rank Math SEO PRO 3.0.123 (downloaded or updated between October 15, 2026 20:02 UTC and October 16, 2026 07:12 UTC)

Timeline

  • 2026-10-19: disclosed
  • 2026-10-16: patched: Version 3.0.124 released as clean replacement on October 16, 2026

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.