Copies of Rank Math PRO, the paid tier of the Rank Math SEO plugin for WordPress, downloaded from rankmath.com or delivered as automatic updates between 20:02 UTC on 15 October and 07:12 UTC on 16 October contained malware, Rank Math said in a security notice. Any site that installed and activated one of those copies should be treated as compromised, and the malware can recreate its hidden backdoor whenever someone visits the site. Rank Math removed the affected files and released a clean 3.0.124, but installing it does not remove files, administrator accounts or scheduled tasks the malware may already have placed. Wordfence warns attackers may have left PHP backdoors in other plugin, theme and must-use plugin directories, altered .htaccess so .cache files execute as PHP, and added SSH keys, so owners should assume any password, database credential or API key the site could reach was exposed. Version numbers do not indicate exposure. Wordfence assigned CVE-2026-111862 and rated it 9.8; the free WordPress.org plugin, with more than four million active installs, is not affected.

• Source article