Rank Math PRO 3.0.123 Was a Supply-Chain Backdoor - Floor 3.0.124

CVE-2026-111862 is Wordfence’s name for a supply-chain compromise in Rank Math SEO PRO 3.0.123. Wordfence rates it 9.8 critical (CVSS 3.1). Rank Math says a subset of 3.0.123 packages downloaded or updated between 15 October 2026 20:02 UTC and 16 October 2026 07:12 UTC contained malware. They pulled those files and shipped 3.0.124 the same day.[1][2][3]

If a site activated an affected copy, Rank Math’s instruction is to treat the site as compromised. Updating the plugin is not cleanup.[1][2]

What it is

This is not an unauthenticated hole in Rank Math’s SEO code. It is CWE-506: embedded malicious code in some copies of a paid plugin zip served from the vendor site.[3]

Rank Math’s own notice: the malware can persist, talk to rank1cdn.com, rebuild a hidden backdoor on page views, and expose anything the web user can read - WordPress passwords, database credentials, API keys, other secrets on the box.[1]

The free plugin on WordPress.org (seo-by-rank-math) is out of scope. Rank Math says only PRO is in this incident. They also say a system refresh deleted some free rankmath.com accounts registered 13-16 October; that is an account issue, not malware on the free plugin.[1]

Version 3.0.123 by itself does not prove compromise. Rank Math limits the claim to packages obtained inside that 11-hour window. They say they have records of who downloaded an affected copy, and they emailed those users.[1][2]

How serious

A 9.8 on a supply-chain drop is “the zip was already the attacker.” Activation is enough. Rank Math’s recovery order exists because the implant rewrites itself if you delete files first.[1]

This is not on CISA’s Known Exploited Vulnerabilities catalog as of this morning (catalog version 2026.10.21, 1,754 entries; newest adds are Plex / SiteGuard / Siemens, not this CVE). Absence from KEV is not a clean bill of health - it means CISA has not listed it as confirmed in-the-wild under that program.[4][3]

BleepingComputer published a VirusTotal PHP sample that shares Rank Math’s IoCs (xmmqhn, _np5pvf754c, #ms6v46, wpsupport_ / @wp-mail.net). They could not confirm that sample was the dropper inside the compromised plugin. Treat it as same-family telemetry, not as a second official package.[5]

Who is affected

In scope, per Rank Math and Wordfence:[1][2]

Rank Math PRO sites that downloaded or auto-updated to 3.0.123 between 20:02 UTC 15 Oct and 07:12 UTC 16 Oct, and activated it - treat as compromised.
Installed 3.0.123 in that window but never activated - delete the folder, install 3.0.124, scan. Rank Math does not call that a confirmed compromise.
Downloaded but never installed - Rank Math says this incident alone does not indicate compromise.
Free plugin from wordpress.org - not this bug.
PRO 3.0.123 obtained outside that window - vendor says not this package set. Still hunt if you have no timestamps.

Plugin directory on disk is rank-math-pro. Wordfence’s slug for the PRO product is seo-by-rank-math-pro. Floor: 3.0.124, from the Rank Math account, not from a random email link.[1][2][6]

What to do now

Inventory PRO, with mtime, not just version. 3.0.123 outside the window is a different claim than 3.0.123 inside it.

# one site - Wordfence slug. If it 404s, use the folder find below.
wp plugin get seo-by-rank-math-pro --field=version --path=/home/USER/public_html

# cPanel box, every account (read-only). Folder name is Rank Math's.
find /home -type d -path '*/wp-content/plugins/rank-math-pro' 2>/dev/null \
  | while read -r d; do
      f=$(ls "$d"/*.php 2>/dev/null | head -1)
      [ -n "$f" ] || continue
      ver=$(awk -F': ' '/^[[:space:]]*\*?[[:space:]]*Version:/{print $2; exit}' "$f")
      echo "$ver  $(stat -c '%y' "$d")  $d"
    done

If Rank Math emailed you, or mtime falls in the window and the plugin was active: restore first. Rank Math’s preferred recovery is a files + database backup from before 15 Oct 2026 20:02 UTC. Then scan, rotate secrets, then install 3.0.124 from rankmath.com.[1]
Do not “just update.” 3.0.124 replaces the plugin zip. It does not remove mu-plugins, fake core files, extra admins, crontab, or .cache PHP the implant already wrote.[1][2]
If there is no clean backup, follow Rank Math’s order before deleting random PHP:[1]
- Delete the entire rank-math-pro folder (deactivate is not enough).
- Delete wp_options rows named _uf6qdn2hmm, t8krdk990phb, or _np5pvf754c.
- Block outbound rank1cdn.com.
- Then hunt the IoCs in the next section.
Rotate everything the web user could read, even after a restore: WordPress users, wp-config.php DB user, salts, SMTP/payment/API keys, panel/FTP/SSH, 2FA on admins.[1]
Install 3.0.124 from rankmath.com in the browser, not from a link in mail. Rank Math says they will not email login or download URLs.[1][6]

Compromise signs (vendor IoCs)

Presence is a hunt target. Absence is not proof of cleanliness.[1][2]

Outbound to rank1cdn.com
wp_options: _uf6qdn2hmm, t8krdk990phb, _np5pvf754c
Admins named wpsupport_* or email @wp-mail.net
File wp-includes/class-wp-cache-util.php - Rank Math says this is not WordPress core
PHP with base64_decode plus XOR, key xmmqhn, proc_open, or PHP-FPM socket code, including under mu-plugins/, other plugins, theme inc/ includes/ lib/
.htaccess rules that execute .cache as PHP; .cache files that contain PHP
System crontab tagged #ms6v46
PHP under uploads/

wp option get _uf6qdn2hmm --path=/home/USER/public_html
wp option get t8krdk990phb --path=/home/USER/public_html
wp option get _np5pvf754c --path=/home/USER/public_html
wp user list --role=administrator --path=/home/USER/public_html
wp core verify-checksums --path=/home/USER/public_html
test -f /home/USER/public_html/wp-includes/class-wp-cache-util.php && echo FAKE_CORE
crontab -u USER -l 2>/dev/null | grep -F '#ms6v46' || true

Keep copies of logs and the plugin folder before you delete. We are not publishing exploit or implant reconstruction.

FAQ

Is the free Rank Math plugin on wordpress.org affected? Rank Math says no.[1]

Is every 3.0.123 install owned? No. Vendor scope is the 11-hour download/update window, and activation.[1][2]

Does updating to 3.0.124 finish the job? Only if nothing else was written. Rank Math and Wordfence both say an activated affected copy needs restore or a full hunt.[1][2]

Is this CISA KEV? Not as of 22 October 2026 morning. Do not wait for a KEV row to hunt PRO sites.[4]

Should I click the email “reset / download” link? Rank Math says navigate to rankmath.com yourself. Treat unsolicited reset/download mail as phishing.[1]

Honesty

We did not install the malware or replay the dropper.
Package hashes for “good” vs “bad” 3.0.123 were not published in the vendor notice we used. Timestamp + vendor email is what they gave operators.[1]
BleepingComputer’s VirusTotal sample is not confirmed as the plugin payload.[5]
“Limited number of users” is Rank Math’s wording, not a count we verified.[1]

Sources

[1] https://rankmath.com/kb/pro-3-0-123-security-incident/ - Rank Math incident notice (published 16 Oct 2026)
[2] https://www.wordfence.com/blog/2026/10/rank-math-seo-pro-3-0-123-malware/ - Wordfence PSA (17 Oct 2026)
[3] https://www.cve.org/CVERecord?id=CVE-2026-111862 - CVE-2026-111862 (CNA: Wordfence, published 19 Oct 2026)
[4] https://www.cisa.gov/known-exploited-vulnerabilities-catalog - KEV catalog, checked 22 Oct 2026
[5] https://www.bleepingcomputer.com/news/security/wordpress-seo-plugin-rank-math-compromised-to-backdoor-websites/ - BleepingComputer, 19 Oct 2026
[6] https://rankmath.com/changelog/pro/ - PRO 3.0.124, 16 Oct 2026