Rank Math Supply Chain Attack Hits WordPress
A Rank Math supply chain attack put malware into the premium plugin’s update channel: version 3.0.123 of Rank Math PRO, downloaded or updated between October 15 (20:02 UTC) and October 16 (07:12 UTC), contained a backdoor. The window lasted about 11 hours. The vendor’s clean build is 3.0.124, and the free plugin from WordPress.org is not affected.
What Happened
Rank Math says the malicious build could compromise a site once the plugin was activated. The CVE is CVE-2026-111862. According to the vendor notice, the malware recreates a hidden backdoor whenever a visitor loads the site, which is why deleting single files does not work. It also creates administrator accounts and contacts an attacker-controlled domain. The vendor lists these indicators: outbound traffic to rank1cdn[.]com, administrator accounts whose names start with wpsupport_, the mail domain wp-mail[.]net, a fake core file wp-includes/class-wp-cache-util.php, .cache files made executable as PHP through .htaccess, and a scheduled task tagged #ms6v46.
Follow the vendor’s current notice, which may be updated. The recommended path is a restore from a backup taken before the incident. The manual path is to delete the whole rank-math-pro folder and then the three wp_options entries the vendor names, in that order. Rank Math also refreshed its own systems and deleted free-user accounts registered between October 13 and 16, so affected users must create a new account.
Why It Matters
The update arrived through the one route everyone is told to trust. Premium plugins are distributed outside the WordPress.org review process, and many sites update them automatically. An SEO plugin is also the kind of tool a marketing team installs without IT being asked, so the site may not be on anyone’s asset list.
Assumption: WordPress with a handful of commercial plugins is a common web stack in DACH small and mid-sized companies. A compromised site is also a GDPR question: if the site reads customer data, form submissions or order data, the secrets it could reach are exposed, and the incident-handling clock starts when you learn about it.
What You Should Do Now
- Check the version and the date. In the WordPress plugin list, look at the installed Rank Math PRO version and when it was last updated. A site that ran 3.0.123 in the window above, even briefly, counts as compromised. Updating to 3.0.124 alone does not remove the backdoor.
- Clean up the vendor’s way. Restore from a backup taken before October 15 where you can. Otherwise follow the vendor’s manual steps: delete the whole rank-math-pro folder first, then the three listed wp_options entries, so the backdoor cannot recreate itself.
- Rotate everything the site can reach. Change WordPress administrator and database passwords, regenerate the security salts, and replace API and payment keys, SMTP credentials, hosting panel and SSH access.
- Hunt for the indicators. Look for administrator accounts starting with wpsupport_, the fake cache utility file, unexpected scheduled tasks and outbound requests to the listed domains, and keep logs for forensics.
DIESEC Perspective
The Rank Math supply chain case shows that automatic updates mean trusting the vendor’s release channel. Put every commercial plugin on your asset list with an owner, stage updates on a test copy where the site matters, and keep one restore point from before the last update that you have actually tested.
Not sure which plugins your WordPress sites run or whether one of them took the bad build? Contact DIESEC for a WordPress exposure check and compromise assessment.
Sources: Rank Math security notice | The Hacker News
Published: 2026-10-23 | Category: Supply Chain Security | ~4 min read
