🚨 Malicious Rank Math PRO update delivered a self-restoring WordPress backdoor
Copies of Rank Math PRO 3.0.123 downloaded or installed through updates between October 15 at 20:02 UTC and October 16 at 07:12 UTC contained malware.
⠀
Activated copies could create persistent backdoors, administrator accounts, scheduled tasks and other malicious files. Credentials, database passwords and API keys accessible to compromised sites may also have been exposed.
⠀
Tracked as CVE-2026-111862, the incident carries a CVSS score of 9.8.
Rank Math released a clean version, 3.0.124, but updating alone does not remove backdoors already planted elsewhere. Affected websites should be treated as compromised and restored from a clean backup where possible.
The free Rank Math plugin available through WordPress.org was not affected.
