October 19, 2026: Rank Math disclosed that its update servers were compromised and a malicious backdoor was injected into Rank Math PRO v3.0.123 WordPress plugin. The backdoor (CVE-2026-111862, severity 9.8/10) provided attackers with persistent remote access, credential theft, SSH key injection, and unauthorized administrator account creation capabilities. The malware distribution window was October 15-16, 2026. Affected: Rank Math PRO paid plugin customers; free WordPress.org version unaffected. Canonical: rank-math-pro-backdoor2026. Source: The Hacker News.
What happened
Between October 15-16, 2026, attackers gained access to Rank Math's download and update infrastructure. They modified Rank Math PRO v3.0.123 to include a persistent PHP backdoor before distribution. Customers who downloaded or auto-updated to this version received malware-infected plugin code. The backdoor created a hidden administrator account, stole API keys, modified .htaccess files, and injected SSH keys for persistent access. Rank Math released a patched version (v3.0.124) within hours of discovery. Attackers registered a malicious C2 domain (rank1cdn[.]com) on October 14, one day before the attack window.
Technical analysis
Vulnerability: CVE-2026-111862 - PHP backdoor in Rank Math PRO WordPress plugin; CVSS score 9.8 (Critical).
Malware capabilities: Self-restoring hidden backdoor (survives plugin deactivation), persistent remote code execution, credential/API key theft, .htaccess web server configuration modification, SSH key injection for shell access, unauthorized administrator account creation, information disclosure.
Distribution vector: Official rankmath.com download servers and automatic WordPress plugin updates. Only the paid PRO version was compromised; free WordPress.org version remained clean. Attack affected unknown number of PRO subscribers who auto-updated during October 15-16 window.
Detection difficulty: Hidden backdoor designed to remain invisible to site administrators; persistent across plugin deactivation and reactivation. Malware may hide in encoded files or database entries, making manual inspection ineffective.
Impact
Scope: Unknown exact number of Rank Math PRO customers; automatic updates may have deployed backdoor without user action or awareness.
Risks: Complete WordPress site compromise, database access, content modification/deletion, malware deployment to site visitors, credential theft (admin accounts, hosting credentials, API keys), SEO poisoning, site blacklisting.
WordPress plugin backdoors are particularly dangerous because they execute with full site privileges and are difficult to detect. Attackers can leverage compromised WordPress sites to attack other sites, form botnets, or steal customer data.
What to do
- Verify plugin version: Check WordPress admin dashboard for Rank Math version. If running 3.0.123, you have the malicious version.
- Update immediately: Upgrade to Rank Math PRO 3.0.124 or later from WordPress admin panel or rankmath.com.
- Scan for backdoors: Use WordPress security plugins (Wordfence, Sucuri) to scan for malware and hidden accounts.
- Check for hidden admin accounts: Review WordPress Users list for suspicious accounts created October 15-16.
- Review .htaccess: Check your website's .htaccess file for unexpected modifications or suspicious rules.
- Check SSH keys: Review authorized SSH keys on your hosting account for unauthorized entries.
- Review recent file changes: Check for unexpected file modifications during October 15-16 window.
- Change credentials: Reset WordPress admin passwords, hosting/SSH credentials, and API keys if any signs of compromise found.
Related reading
See WordPress security and plugin vetting.
Sources
The Hacker News • SecurityWeek • Verified by Wordfence and Patchstack security researchers