Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor
Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a security notice published on October 16. Any site that installed and activated one of those copies should be treated as compromised, and the
Between October 15 and 16, Rank Math PRO, the paid version of the popular Rank Math SEO plugin for WordPress, was found to have been infected with malware. The malware can recreate a hidden backdoor each time a site visitor accesses it. Rank Math has removed the infected files and released a clean version, 3.0.124, but reinstating the plugin does not automatically remove the malware or any malicious components that may have been placed elsewhere on the server.
Wordfence has assigned the incident the high severity CVE-2026-111862 and rates it 9.8 out of 10. It is recommended to restore from a backup taken before October 15, run a security scan, change every password and credential, and then install the clean version 3.0.124 from Rank Math's official website. The free version of Rank Math SEO plugin on WordPress.org, which has over 4 million active installations, is not affected by this incident.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
Also reported by 1 other outlet
- Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack securityweek.com
