Affected Systems

Rank Math PRO (paid WordPress SEO plugin) version 3.0.123 downloaded or auto-updated from rankmath.com between 20:02 UTC October 15 and 07:12 UTC October 16, 2026. Free version on WordPress.org (4M+ installs) not affected. Clean version 3.0.124 released but does not remove malware artifacts.

Exploitation Status

Active supply chain compromise. Malware was distributed through official vendor infrastructure (rankmath.com) for approximately 11 hours. Self-restoring backdoor recreates itself on site visits. CVE-2026-111862 assigned, CVSS 9.8. Attacker identity unknown.

Business Impact

Sites that installed and activated the compromised plugin during the window must be treated as fully compromised. Malware creates persistent backdoors via scheduled tasks, fake admin accounts (wpsupport_*), rogue PHP files across multiple directories, modified .htaccess, SSH keys, and external C2 (rank1cdn[.]com). All credentials, API keys, database passwords, and secrets potentially exfiltrated. Deactivation insufficient—backdoor self-restores. Manual cleanup complex and time-intensive; restore from pre-October 15 backup strongly preferred.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately delete entire rank-math-pro plugin folder via file manager or FTP—do not merely deactivate
  • Delete wp_options table entries with option_name values: _uf6qdn2hmm, t8krdk990phb, _np5pvf754c
  • Block outbound connections to rank1cdn[.]com at firewall or hosting provider level
  • If clean backup exists from before 20:02 UTC October 15, restore site and database, then rotate all credentials before installing clean 3.0.124 from rankmath.com
  • If no backup: hunt for malicious PHP files in wp-content/mu-plugins/, other plugin folders, theme inc/includes/lib/ directories, uploads/, and fake wp-includes/class-wp-cache-util.php; search code for base64_decode with XOR, key 'xmmqhn', proc_open, PHP-FPM socket code
  • Remove administrator accounts with usernames starting wpsupport_ or emails ending @wp-mail[.]net
  • Check .htaccess for rules allowing .cache files to execute as PHP; delete malicious .cache files
  • Inspect crontab for entries tagged #ms6v46, WordPress scheduled events, SSH authorized_keys, and running processes
  • Rotate all WordPress passwords, database credentials in wp-config.php, security keys/salts, API keys (payment, SMTP), hosting/FTP/SSH access, environment variables, and 2FA for admins
  • Run security scan, wp core verify-checksums, and wp plugin verify-checksums --all after cleanup, then install clean 3.0.124 from rankmath.com account