Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-111862— Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code

Quick assessment

Affected
RankMath Rank Math SEO PRO
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件 Rank Math SEO PRO 的部分 3.0.123 版本包在 2026 年 10 月 15 日 20:02 UTC 至 2026 年 10 月 16 日 07:12 UTC 期间下载或更新时，遭遇了供应链攻击。Rank Math 表示，受影响的插件文件包含恶意软件，若激活该插件，可能导致网站被入侵，并建议已激活受影响包的用户将相关网站视为已被攻陷。该恶意软件可建立持久化访问通道、与 rank1cdn[.]com 通信、在页面访问时重新生成隐藏后门，并泄露 Web 服务器可访问的 W

CVSS 9.8 · Critical EPSS 0.66% · P51

Affected Version Matrix 1

VendorProduct Version RangeStatus
RankMath Rank Math SEO PRO 3.0.123 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-111862

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code
Source: CVE Program / CVE List V5
Vulnerability Description
Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a website if the plugin was activated and directs sites that activated an affected package to treat the website as compromised. The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server. Rank Math identifies three malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker as incident indicators. Only packages obtained during the vendor-confirmed window are claimed as affected; version 3.0.123 alone is not sufficient to establish compromise. Rank Math removed the affected files and released version 3.0.124 as the clean replacement.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
内嵌的恶意代码
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
RankMath Rank Math SEO PRO 3.0.123 -

II. Public POCs for CVE-2026-111862

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-111862

请登录查看更多情报信息。

Vendor Pages for CVE-2026-111862 (2)

Other References for CVE-2026-111862 (1)

IV. Related Vulnerabilities

Same product: Rank Math SEO PRO
Same vendor: RankMath
Same weakness: CWE-506