Supply-Chain Compromise in Rank Math SEO PRO for WordPress

CVE-2026-111862

What is CVE-2026-111862?

Rank Math SEO PRO for WordPress experienced a significant supply-chain compromise affecting specific versions downloaded within a narrow timeframe. Users who updated between October 15, 2026, 20:02 UTC, and October 16, 2026, 07:12 UTC, potentially received malware-laden plugin files. This malware could undermine website integrity once the compromised plugin was activated, leading to serious security risks. Affected sites might face unauthorized access, persistent vulnerabilities, exposure of critical credentials, and the establishment of hidden backdoors. Rank Math identified several indicators of the attack, including malicious wp_options keys and unauthorized administrator accounts. They have since addressed the issue by releasing a clean version, 3.0.124, while advising users with the affected version to consider their sites compromised.

References