Rank Math PRO WordPress plugin hijacked to deliver malware

The paid version of the Rank Math PRO WordPress SEO plugin was compromised by malware that delivered a self-restoring backdoor. The incident affected official distributions and updates downloaded from rankmath.com between 20:02 UTC on October 15 and 07:12 UTC on October 16.

Security researchers indicate the attack likely targeted the development company's own systems. The malicious code, tracked as CVE-2026-111862 with a severity score of 9.8, allows attackers to maintain access by creating unauthorized administrator accounts, scheduled tasks, or hidden files elsewhere on the server.

Rank Math has released a clean version, 3.0.124, to replace the affected files. However, security experts warn that simply updating the plugin is insufficient for compromised sites, as the malware can recreate its presence. Affected users are advised to restore clean backups from before the incident, change all login credentials, and perform thorough manual security audits to remove persistent backdoors or unauthorized accounts.