Threat reportSupply ChainTL-2026-3902
Rank Math PRO WordPress Plugin Supply Chain Compromise (v3.0.123, CVE-2026-111862)
Rank Math PRO WordPress Plugin Supply Chain Compromise (TL-2026-3902), also tracked as Rank Math PRO 3.0.123 security incident, is a critical-severity supply-chain compromise scored CVSS 9.8, first published 2026-10-19 and last reviewed 2026-10-20. It has no confirmed attribution, affects Rank Math Rank Math PRO (SEO) WordPress plugin, references 1 CVE (CVE-2026-111862), maps to 13 MITRE ATT&CK techniques (T1027, T1036.005, T1053.003), and is covered by 9 detection rules and 20 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 13MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 20Indicators of compromise
Key facts for TL-2026-3902
- Threat ID
- TL-2026-3902
- Also known as
- Rank Math PRO 3.0.123 security incident
- Severity
- CRITICAL
- CVSS
- 9.8
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, news - media, ecommerce, small-business
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 20
- Updates
- 2026-10-20 · 3 updates · revalidated 3× · latest source
Malware and tooling in Rank Math PRO WordPress Plugin Supply Chain Compromise
Malware and tooling: PHP, Rank Math PRO 3.0.123 backdoor
How Rank Math PRO WordPress Plugin Supply Chain Compromise works
Trojanized Rank Math PRO v3.0.123 packages were distributed from 2026-10-15 20:02 UTC to 2026-10-16 07:12 UTC. The malware creates hidden admin accounts, exposes credentials and API keys, and recreates a hidden backdoor on each page visit. Rank Math removed the files and released clean v3.0.124.
Rank Math disclosed that a limited number of users who downloaded Rank Math PRO v3.0.123 from the vendor between 2026-10-15 20:02 UTC and 2026-10-16 07:12 UTC received plugin files containing malware. The paid PRO build served from vendor infrastructure was affected; the free WordPress.org plugin was not. Downloading the package without installing or activating it does not by itself indicate compromise. Rank Math instructs that any site that installed and activated the affected build in the window be treated as compromised.
Per the vendor incident page and the SecurityWeek report, the payload gives the attacker persistent access, can expose WordPress credentials, database details and API keys, and recreates a hidden backdoor each time a page is loaded, which makes manual cleanup difficult. Reported artifacts: outbound connections to the attacker domain rank1cdn.com; hidden administrator accounts with usernames beginning wpsupport_ and emails ending @wp-mail.net; three malicious wp_options rows (_uf6qdn2hmm, t8krdk990phb, _np5pvf754c); a fake WordPress core file wp-includes/class-wp-cache-util.php; PHP files planted in wp-content/mu-plugins/, uploads, other plugin folders, the Rank Math includes/ folder and theme inc/, includes/, lib/ directories; .htaccess rules that execute .cache files as PHP, and .cache files containing PHP; code using base64_decode with XOR loops (key xmmqhn), proc_open or PHP-FPM socket code; and cron entries carrying the marker #ms6v46. The malware also reportedly manipulates plugins/themes, cron jobs and SSH authorized_keys outside WordPress.
Secondary reporting (SecurityOnline, BugShield, Bearmor) attributes CVE-2026-111862 with CVSS 9.8 to this incident and cites Wordfence; a direct NVD query for that ID returned no record at research time, and the CVSS vector and CWE were not published in any fetched source, so they are left empty. No threat actor attribution, affected-site count or initial compromise vector (how the attacker injected the code into the distribution pipeline) has been disclosed. A BeaconBeagle domain search for rank1cdn.com returned no matches.
Remediation per Rank Math: preferably restore both files and database from a clean backup made before 2026-10-15, then scan, rotate all credentials and API keys (including wp-config salts, database, hosting/FTP/SSH logins) and install v3.0.124. If no backup exists, delete the rank-math-pro folder, remove the three malicious wp_options rows, block rank1cdn.com, remove backdoor files and rogue accounts, audit .htaccess, cron jobs and SSH keys, and verify core and plugin checksums.
MITRE ATT&CK techniques used in TL-2026-3902
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1564.001 Hidden Files and Directories
Persistence
T1053.003 Cron; T1098.004 SSH Authorized Keys; T1136.001 Local Account; T1505.003 Web Shell
Execution
T1059 Command and Scripting Interpreter
Command and Control
Initial Access
T1195.002 Compromise Software Supply Chain
Credential Access
T1552.001 Credentials In Files
Resource Development
Affected products and versions in Rank Math PRO WordPress Plugin Supply Chain Compromise
- Rank Math — Rank Math PRO (SEO) WordPress plugin
Vulnerable versions: 3.0.123 (packages downloaded 2026-10-15 20:02 UTC to 2026-10-16 07:12 UTC)
Fixed in: 3.0.124
Remediation for Rank Math PRO WordPress Plugin Supply Chain Compromise
Patches
- Install clean Rank Math PRO v3.0.124
Immediate actions
- Treat any site that installed and activated Rank Math PRO 3.0.123 during 2026-10-15 20:02 UTC to 2026-10-16 07:12 UTC as fully compromised
- Block outbound connections to rank1cdn.com at firewall/hosting level
- Delete the rank-math-pro plugin folder and remove wp_options rows _uf6qdn2hmm, t8krdk990phb and _np5pvf754c
- Remove unknown administrator accounts (wpsupport_*, @wp-mail.net), fake class-wp-cache-util.php, .cache PHP files and malicious .htaccess rules
- Audit cron jobs (marker #ms6v46) and SSH authorized_keys for unauthorized entries
Workarounds
- Restore files and database from a clean backup made before 2026-10-15, then scan with Wordfence or Sucuri
- If no backup exists, perform manual removal per the vendor KB and re-verify checksums
Longer-term hardening
- Rotate all WordPress user passwords, database credentials, hosting/FTP/SFTP/SSH logins, API keys and wp-config.php security keys and salts
- Verify integrity with wp core verify-checksums and wp plugin verify-checksums --all
- Enforce two-factor authentication on administrator accounts and monitor for reappearance of removed files
- Stage and delay premium plugin updates and monitor outbound traffic from web servers
CVEs associated with Rank Math PRO WordPress Plugin Supply Chain Compromise
Weaknesses (CWE) in Rank Math PRO WordPress Plugin Supply Chain Compromise
Timeline of Rank Math PRO WordPress Plugin Supply Chain Compromise
- Free Rank Math SEO plugin on WordPress.org last updated; it was not affected by the compromise (per The Hacker News).
- Rank Math PRO v3.0.123 reportedly released (per Bearmor); file modification dates and logs are needed to establish true install timing relative to the compromise window
- C2 domain rank1cdn.com registered at 19:31 UTC, about a day before the malicious distribution window opened (per The Hacker News).
- At 20:02 UTC, Rank Math PRO v3.0.123 packages containing malware begin to be distributed to downloading users
- Clean Rank Math PRO v3.0.124 made available; the vendor page does not state the exact release date, which is inferred from the window close and the vendor disclosure
- Rank Math discloses the incident (per SQ Magazine), removes the malicious files from distribution and publishes its security incident KB page; the KB gives no exact timestamps for detection or removal
- At 07:12 UTC, the malicious distribution window ends; Rank Math removes the affected files
- Wordfence Threat Intelligence publishes a PSA and vulnerability record (ID 81cd7a2c-ad0c-4dbc-b5dc-07ec866d5c1f) assigning CVE-2026-111862 with CVSS 9.8; SecurityOnline reports the same day
- CVE-2026-111862 (CVSS 9.8, CWE-506) published in NVD, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; The Hacker News reports the incident.
- SecurityWeek and SQ Magazine publish coverage of the supply chain compromise, with vendor IOCs and remediation guidance
Update history for TL-2026-3902
- 2026-10-20 — Rank Math PRO 3.0.123 WordPress Plugin Supply-Chain Compromise Delivers Self-Restoring Backdoor (CVE-2026-111862): What changed No severity, exploitability, status or score change; existing values (CRITICAL, ACTIVE, 9.8) already match the newer report. New timeline Two events added: free plugin last update (2026-10-06) and NVD publication of CVE-2026-11
- 2026-10-20 — Rank Math PRO WordPress Plugin Supply-Chain Compromise (v3.0.123, CVE-2026-111862) Installs Self-Rebuilding Backdoors: What changed No severity, exploitability, status, CVSS or attribution change; all remain CRITICAL / ACTIVE / ACTIVE / 9.8 / unattributed (LOW confidence). New indicators (1) 1 new behavioral indicator: proc_open (vendor detection signature,
- 2026-10-19 — Rank Math PRO WordPress plugin v3.0.123 supply-chain compromise delivers self-restoring backdoor (CVE-2026-111862): What changed No severity/exploitability/status change (already CRITICAL / ACTIVE). Adds detail: v3.0.123 was first released clean on 2026-10-07, so tampering occurred on the distribution side; updating to v3.0.124 does NOT remove the backdo
Sources cited for Rank Math PRO WordPress Plugin Supply Chain Compromise
- Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack - SecurityWeek
- Rank Math KB - Pro 3.0.123 Security Incident
- Rank Math SEO PRO Supply-Chain Compromise Exploited in the Wild via Version 3.0.123 - SecurityOnline
- Rank Math SEO PRO 3.0.123 malware: check your download time and recover safely - BugShield
- Rank Math PRO 3.0.123 Malware: Check and Clean Your Site - Bearmor
- PT-2026-116378 - Positive Technologies vulnerability database entry (via Vulners)
- Supply-Chain Compromise Injects Malware into Some Rank Math SEO PRO Downloads - Mallory
- PSA: Malware Found in Some Rank Math SEO PRO 3.0.123 Downloads - Wordfence (mirrored on Malware News)
- Rank Math SEO PRO 3.0.123 Malware: What Site Owners Must Do - SQ Magazine
Detection coverage for TL-2026-3902
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3902 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.