# Rank Math PRO WordPress Plugin Supply Chain Compromise (v3.0.123, CVE-2026-111862)

> Trojanized Rank Math PRO v3.0.123 packages were distributed from 2026-10-15 20:02 UTC to 2026-10-16 07:12 UTC. The malware creates hidden admin accounts, exposes credentials and API keys, and recreates a hidden backdoor on each page visit. Rank Math removed the files and released clean v3.0.124.

- **Published:** 2026-10-19T16:23:24Z
- **Last reviewed:** 2026-10-20T08:40:20.167Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3902
- **ID:** TL-2026-3902
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-111862

## Description

Rank Math disclosed that a limited number of users who downloaded Rank Math PRO v3.0.123 from the vendor between 2026-10-15 20:02 UTC and 2026-10-16 07:12 UTC received plugin files containing malware. The paid PRO build served from vendor infrastructure was affected; the free WordPress.org plugin was not. Downloading the package without installing or activating it does not by itself indicate compromise. Rank Math instructs that any site that installed and activated the affected build in the window be treated as compromised.

Per the vendor incident page and the SecurityWeek report, the payload gives the attacker persistent access, can expose WordPress credentials, database details and API keys, and recreates a hidden backdoor each time a page is loaded, which makes manual cleanup difficult. Reported artifacts: outbound connections to the attacker domain rank1cdn.com; hidden administrator accounts with usernames beginning wpsupport_ and emails ending @wp-mail.net; three malicious wp_options rows (_uf6qdn2hmm, t8krdk990phb, _np5pvf754c); a fake WordPress core file wp-includes/class-wp-cache-util.php; PHP files planted in wp-content/mu-plugins/, uploads, other plugin folders, the Rank Math includes/ folder and theme inc/, includes/, lib/ directories; .htaccess rules that execute .cache files as PHP, and .cache files containing PHP; code using base64_decode with XOR loops (key xmmqhn), proc_open or PHP-FPM socket code; and cron entries carrying the marker #ms6v46. The malware also reportedly manipulates plugins/themes, cron jobs and SSH authorized_keys outside WordPress.

Secondary reporting (SecurityOnline, BugShield, Bearmor) attributes CVE-2026-111862 with CVSS 9.8 to this incident and cites Wordfence; a direct NVD query for that ID returned no record at research time, and the CVSS vector and CWE were not published in any fetched source, so they are left empty. No threat actor attribution, affected-site count or initial compromise vector (how the attacker injected the code into the distribution pipeline) has been disclosed. A BeaconBeagle domain search for rank1cdn.com returned no matches.

Remediation per Rank Math: preferably restore both files and database from a clean backup made before 2026-10-15, then scan, rotate all credentials and API keys (including wp-config salts, database, hosting/FTP/SSH logins) and install v3.0.124. If no backup exists, delete the rank-math-pro folder, remove the three malicious wp_options rows, block rank1cdn.com, remove backdoor files and rogue accounts, audit .htaccess, cron jobs and SSH keys, and verify core and plugin checksums.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1505.003 Web Shell
- T1136.001 Local Account
- T1053.003 Cron
- T1098.004 SSH Authorized Keys
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1564.001 Hidden Files and Directories
- T1552.001 Credentials In Files
- T1071.001 Web Protocols
- T1583.001 Acquire Infrastructure
- T1059 Command and Scripting Interpreter

## Sources

- [Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack - SecurityWeek](https://www.securityweek.com/rank-math-pro-wordpress-plugin-compromised-in-supply-chain-attack/)
- [Rank Math KB - Pro 3.0.123 Security Incident](https://rankmath.com/kb/pro-3-0-123-security-incident/)
- [Rank Math SEO PRO Supply-Chain Compromise Exploited in the Wild via Version 3.0.123 - SecurityOnline](https://securityonline.info/rank-math-seo-pro-compromise-exploited/)
- [Rank Math SEO PRO 3.0.123 malware: check your download time and recover safely - BugShield](https://bugshield.co.uk/blog/rank-math-seo-pro-3-0-123-malware)
- [Rank Math PRO 3.0.123 Malware: Check and Clean Your Site - Bearmor](https://bearmor.eu/rank-math-pro-3-0-123-malware-check-cleanup/)
- [PT-2026-116378 - Positive Technologies vulnerability database entry (via Vulners)](https://vulners.com/ptsecurity/PT-2026-116378)
- [Supply-Chain Compromise Injects Malware into Some Rank Math SEO PRO Downloads - Mallory](https://mallory.ai/stories/01a14813-c6db-7c0c-8362-25d8430a0582)
- [PSA: Malware Found in Some Rank Math SEO PRO 3.0.123 Downloads - Wordfence (mirrored on Malware News)](https://malware.news/t/psa-malware-found-in-some-rank-math-seo-pro-3-0-123-downloads/126510)
- [Rank Math SEO PRO 3.0.123 Malware: What Site Owners Must Do - SQ Magazine](https://sqmagazine.co.uk/rank-math-seo-pro-3-0-123-malware/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3902