Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack
Hackers injected malware into Rank Math PRO version 3.0.123 packages distributed between October 15 and October 16. The post Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack appeared first on SecurityWeek .
Between October 15 and 16, Rank Math PRO, the paid version of the popular Rank Math SEO plugin for WordPress, was found to have been infected with malware. The malware can recreate a hidden backdoor each time a site visitor accesses it. Rank Math has removed the infected files and released a clean version, 3.0.124, but reinstating the plugin does not automatically remove the malware or any malicious components that may have been placed elsewhere on the server.
Wordfence has assigned the incident the high severity CVE-2026-111862 and rates it 9.8 out of 10. It is recommended to restore from a backup taken before October 15, run a security scan, change every password and credential, and then install the clean version 3.0.124 from Rank Math's official website. The free version of Rank Math SEO plugin on WordPress.org, which has over 4 million active installations, is not affected by this incident.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
