Rank Math SEO PRO 3.0.123: critical supply-chain compromise

Rank Math SEO PRO 3.0.123: critical supply-chain compromise

What happened and who is affectedRank Math SEO PRO for WordPress has been caught up in a supply-chain compromise tracked as CVE-2026-111862 and rated...

What happened and who is affected

Rank Math SEO PRO for WordPress has been caught up in a supply-chain compromise tracked as CVE-2026-111862 and rated CVSS 3.1 9.8 (CRITICAL) under CWE-506, the weakness class for embedded malicious code. The affected element is not the plugin's codebase as a whole but a subset of version 3.0.123 packages that were downloaded or updated between 15 October 2026 at 20:02 UTC and 16 October 2026 at 07:12 UTC.

A tampered software package leaking a dark thread towards a server rack, next to a clean replacement package

This distinction matters for any shop, agency or SME in Barcelona, Lleida, Tarragona or Girona running WordPress. Having 3.0.123 installed is not, on its own, proof of compromise. What counts is when and from where that package was obtained. Rank Math states that the affected plugin files contained malware capable of compromising a website if the plugin was activated, and it explicitly asks sites that activated an affected package to treat the website as compromised.

Why it is serious even without a KEV listing

At the time of writing, CVE-2026-111862 does not appear in CISA's KEV catalogue, so there is no public confirmation that it is being exploited in the wild and no federal remediation deadline attached to it. That should not be read as reassurance. Supply-chain malware differs from a classic remote vulnerability: the payload arrives through a trusted update channel, with the site owner's own consent, and it runs with the privileges of the web server.

According to Rank Math, the malware could establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys and other secrets reachable from the server. On a PrestaShop or WooCommerce installation, that means customer data, payment-adjacent integrations and admin access — a GDPR incident waiting to be classified, not just a technical nuisance.

What to do today

  • Establish the timeline. Check your update logs, hosting panel or backup metadata to see whether Rank Math SEO PRO 3.0.123 was installed inside the vendor-confirmed window. If it was downloaded outside that window, the vendor does not claim it as affected.
  • Move to the clean release. Rank Math removed the affected files and published version 3.0.124 as the clean replacement. Follow the vendor's own security notice and changelog for the exact procedure rather than improvising.
  • Hunt for the indicators Rank Math published. These include three malicious wp_options keys, hidden PHP backdoors, unauthorised administrator accounts, a fake WordPress core file, PHP-executable .cache files and a system cron marker.
  • Assume credentials are burned. If an affected package was activated, rotate WordPress and database passwords, salts and API keys, and review administrator accounts for anything you did not create.
  • Reduce what the internet can see. Restrict wp-admin and wp-login by IP where practical, remove unused plugins and themes, and check outbound connections for traffic to the domain named in the advisory.

If any indicator is present, treat the site as compromised: preserve logs, take a forensic copy before cleaning, and plan restoration from a backup known to predate the infection window.

How ALMC can help

Incidents like this one are rarely solved by updating a plugin and hoping. Our cybersecurity work for SMEs and online shops starts with a security audit and pentesting to map what is exposed, followed by hardening of servers and CMS installations and disciplined patching of WordPress, PrestaShop and Joomla. When a site has already been hit, we handle incident response and repair of hacked websites: cleaning backdoors, closing the entry point and restoring service without losing evidence. For teams with a small IT department, ongoing monitoring and maintenance means an affected package is detected and contained in hours rather than discovered months later by a customer.

Related

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.