{
  "id": 15637923,
  "title": "Malicious code in paid version of popular WordPress plugin",
  "url": "https://urgent.news/2026/10/19/malicious-code-in-paid-version-of-popular-wordpress-plugin",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-19T18:17:28.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/hacksgr/malicious-code-in-paid-version-of-popular-wordpress-plugin-4cib"
  },
  "original_language": "en",
  "account": "On October 15th and 16th, malicious code infiltrated the paid version of the Rank Math PRO WordPress plugin, affecting only those who downloaded or updated it directly from the plugin's creator's website and not from the official WordPress repository. The vulnerability, identified as CVE-2026-111862, carries a high severity rating of 9.8. This incident left users with compromised websites, as the attackers could potentially exploit hidden files, create unauthorized administrator accounts, alter settings, and maintain persistent backdoors.\n\nThe affected version of the plugin was 3.0.124, which was distributed between 20:02 UTC on October 15 and 07:12 UTC on October 16. According to security researchers, the attack targeted the development company behind the plugin, but the perpetrator's identity remains unknown. The free version of the same plugin was not impacted by this breach.\n\nTo mitigate the damage, users are advised to either restore a clean backup from before the attack or manually clean their systems by deleting the add-on folder, removing specific data, and blocking connections to the offending address. Users should also update their login details and run security checks to ensure their websites are secure. The Rank Math PRO creators have released a clean version to address this issue, but simply installing the new version is not sufficient to remove all traces of the malicious code.",
  "summary": "Official distributions and updates of Rank Math PRO served between October 15 and 16 contained malicious code, tracked as CVE-2026-111862 with a 9.8 severity score. While updating to version 3.0.124 replaces the plugin, it does not remove persistent backdoors, unauthorized admin accounts, or cron tasks left on the server. Who is affected? The issue only affects the paid version of the plugin,…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}