SendFleet now has a WordPress plugin. Try it and tell me what breaks

On October 15th and 16th, malicious code infiltrated the paid version of the Rank Math PRO WordPress plugin, affecting only those who downloaded or updated it directly from the plugin's creator's website and not from the official WordPress repository. The vulnerability, identified as CVE-2026-111862, carries a high severity rating of 9.8.

This incident left users with compromised websites, as the attackers could potentially exploit hidden files, create unauthorized administrator accounts, alter settings, and maintain persistent backdoors.

The affected version of the plugin was 3.0.124, which was distributed between 20:02 UTC on October 15 and 07:12 UTC on October 16. According to security researchers, the attack targeted the development company behind the plugin, but the perpetrator's identity remains unknown. The free version of the same plugin was not impacted by this breach.

To mitigate the damage, users are advised to either restore a clean backup from before the attack or manually clean their systems by deleting the add-on folder, removing specific data, and blocking connections to the offending address. Users should also update their login details and run security checks to ensure their websites are secure. The Rank Math PRO creators have released a clean version to address this issue, but simply installing the new version is not sufficient to remove all traces of the malicious code.