2026 Rank Math PRO — WordPress plugin backdoor; CVE-2026-111862 injected into v3.0.123
Data compromised
WordPress site admin credentials, API keys, SSH credentials, database access via backdoor. Affected WordPress site administrators and visitors.
Technical writeup
Rank Math PRO v3.0.123 compromised Oct 15-16 with persistent PHP backdoor (CVE-2026-111862). Backdoor creates hidden admin account, steals API keys, modifies .htaccess, injects SSH keys. Only paid PRO version affected; free WordPress.org version clean. Patched in v3.0.124. Verified by Wordfence and Patchstack.
Root cause
Compromised rankmath.com download/update servers; malicious PHP backdoor code injected into plugin distribution.