Rank Math SEO PRO Supply-Chain Compromise: Malware Distributed in October 2026

INCIDENT IDENTIFICATION

Product: Rank Math SEO PRO
Component: WordPress SEO plugin
Incident type: Software supply-chain compromise
Threat category: Embedded malicious code / persistent backdoor
CVE identifier: CVE-2026-111862
CVSS v3.1 severity: 9.8 — Critical
Affected release: Selected version 3.0.123 packages
Affected distribution period: 15 October 2026, 20:02 UTC, through 16 October 2026, 07:12 UTC
First clean replacement: Version 3.0.124

The version number alone does not establish compromise. Only packages obtained during the vendor-confirmed affected distribution window are implicated.

INITIAL COMPROMISE MECHANISM

The incident involved malicious code introduced into software distributed through the Rank Math PRO delivery infrastructure.

A website receiving and activating an affected package could execute malicious code within its WordPress environment.

Unlike an ordinary plugin vulnerability that requires attackers to exploit a particular HTTP endpoint, this incident relied on the installation or activation of a contaminated software package.

The available evidence confirms malicious distribution but does not establish every step by which the attacker gained access to the vendor's distribution environment.

MALWARE CAPABILITIES

According to the vendor's security advisory and corroborating security research, the malicious code could:

Establish persistent unauthorised access.

Create hidden PHP backdoors.

Recreate malicious backdoor components when the website receives visits.

Create unauthorised administrator accounts.

Modify files belonging to WordPress plugins or themes.

Introduce files masquerading as legitimate WordPress components.

Modify web server configuration to permit unexpected PHP execution.

Establish malicious scheduled tasks.

Access sensitive credentials and application secrets available to the compromised environment.

These capabilities create a risk of continuing compromise even after the affected plugin package has been replaced.

INDICATORS OF COMPROMISE

Network indicator:

rank1cdn[.]com

This domain was identified in the vendor's security guidance as associated with malicious communications.

WordPress database indicators:

Suspicious option_name values in the WordPress options table:

_uf6qdn2hmm

t8krdk990phb

_np5pvf754c

Administrator account indicators:

Unexpected administrator usernames beginning with:

wpsupport_

Suspicious administrator email addresses ending with:

@wp-mail[.]net

File-system indicators:

wp-includes/class-wp-cache-util.php

The vendor identifies this file as an illegitimate WordPress core component.

Additional suspicious PHP files may appear within:

wp-content/mu-plugins/

Other plugin directories

Non-default theme directories

Unexpected locations within the WordPress installation

Code-level indicators include suspicious combinations of:

base64_decode

XOR-based obfuscation

xmmqhn

proc_open

PHP-FPM socket interaction

Server configuration indicators:

Unexpected .htaccess directives permitting files with .cache extensions to execute as PHP.

Suspicious .cache files containing executable PHP code.

Scheduled task indicators:

System cron entries containing:

#ms6v46

Investigators should also examine unexpected SSH authorised keys, modified crontabs, suspicious processes and unusual files outside the WordPress document root.

These indicators should be evaluated in context. Individual function names are not proof of compromise, and the absence of known indicators does not establish that a website is clean.

POTENTIAL SECURITY IMPACT

A successfully compromised website may expose:

WordPress administrator credentials.

Database credentials.

Application configuration secrets.

API keys.

SMTP credentials.

Payment integration credentials.

Hosting or infrastructure access secrets.

Sensitive information accessible to the web server process.

The potential consequences include unauthorised administrative access, persistent malware infections, website manipulation, malicious redirects, data exposure and further compromise of connected systems.

These are potential consequences of the disclosed capabilities, not confirmation that every affected website experienced every outcome.

EVIDENCE ASSESSMENT

Rank Math directly confirmed the affected distribution period, acknowledged the presence of malware and published recovery instructions.

Wordfence independently documented the incident and associated indicators.

Patchstack registered the supply-chain compromise as CVE-2026-111862, classified the issue as a backdoor and recorded a CVSS severity score of 9.8.

The evidence supports high confidence that malicious plugin packages were distributed.

The reviewed public evidence does not establish a verified total number of compromised WordPress installations.

It also does not establish that widespread exploitation remains active as of this report's preparation.

The confirmed malicious distribution should therefore not be described as an ongoing mass-exploitation campaign without further evidence.