Popular Word Press SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor
Summary: Copies of the paid Rank Math PRO WordPress SEO plugin downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware that can recreate its hidden backdoor whenever someone visits the site. Rank Math removed the affected files and released clean version 3.0.124, but Wordfence notes that installing it does not remove files, administrator accounts, or scheduled tasks the malware may have placed elsewhere on the server.
What you should know: Wordfence rates this 9.8 out of 10 as CVE-2026-111862, and because the attack was on Rank Math's own systems, Patchstack says no rule is possible for mitigation - so any password, database credential, or API key the site could reach should be assumed exposed.
Read the original at The Hacker News ↗
- Topics
- Malware
- Mentions
- CVE-2026-111862
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026