CVE-2026-111862 · Rank Math SEO PRO supply-chain compromise via trojanized v3.0.123…

01 · The Real Story

Someone slipped poison into the restaurant's ingredient delivery truck overnight, and every dish served that morning is contaminated

CVE-2026-111862 is a supply-chain compromise — not a traditional vulnerability. A trojanized build of Rank Math SEO PRO v3.0.123 was served from Rank Math's own distribution infrastructure for approximately 11 hours, from October 15, 2026 20:02 UTC to October 16, 2026 07:12 UTC. Any WordPress site that downloaded or auto-updated to v3.0.123 during that window and activated the plugin received embedded malware (CWE-506). The malware phones home to rank1cdn[.]com, creates self-restoring PHP backdoors on every page visit, drops rogue administrator accounts (wpsupport_* / @wp-mail.net), plants a fake core file at wp-includes/class-wp-cache-util.php, injects .htaccess rules to execute .cache files as PHP, registers system cron jobs (marker #ms6v46), writes SSH authorized_keys, and harvests every credential the web server process can reach — WordPress passwords, database credentials, and API keys. The free Rank Math plugin distributed via WordPress.org is not affected; only the PRO (paid) tier served from Rank Math's servers was trojanized. Rank Math released clean v3.0.124 promptly, but updating merely replaces the plugin — it does not remove the persistent backdoors, rogue accounts, cron entries, or SSH keys left behind.

The vendor/Wordfence CVSS of 9.8 is appropriate and, if anything, slightly understates the operational impact for affected sites. CVSS captures the technical severity (unauthenticated full compromise), but the real damage is worse: multi-layered persistence means a simple patch-and-move-on response will not work. However, the exposure population is narrowed dramatically by the 11-hour distribution window and the PRO-only scope. If you are an enterprise running Rank Math PRO on any WordPress properties, you must determine immediately whether any site updated during that window. If it did, treat the entire server — not just WordPress — as fully compromised.

"If Rank Math PRO updated during the 11-hour window, your server is fully owned. Act now."

02 · The Attack Path

5 steps from start to impact.

STEP 01

Trojanized package served from vendor infrastructure

The attacker compromised Rank Math's distribution pipeline (exact vector undisclosed) and injected malicious PHP into the v3.0.123 PRO package. For ~11 hours, every download or auto-update request received the trojanized build. No user interaction beyond a normal plugin update is required — WordPress auto-update or a one-click dashboard update suffices.

Conditions required:

Site runs Rank Math SEO PRO (paid version)
Plugin was downloaded or updated between Oct 15 20:02 UTC and Oct 16 07:12 UTC

Where this breaks in practice:

Only PRO (paid) users are in scope — the free WordPress.org version is unaffected
The window was ~11 hours, limiting the population to sites that happened to update during that period
Sites with update locks, staging-first workflows, or manual-only update policies may not have pulled the trojanized build

Detection/coverage: Wordfence published IOC signatures. wp plugin verify-checksums --all flags the tampered files. Check wp_options for keys _uf6qdn2hmm, t8krdk990phb, _np5pvf754c.

STEP 02

Malware activates on plugin load

Once the trojanized plugin is activated (which happens automatically if it was an update to an already-active plugin), the embedded malicious code executes in the context of the PHP process. It writes persistence artifacts: rogue wp_options rows, a fake core file (wp-includes/class-wp-cache-util.php), mu-plugins backdoors, .htaccess modifications, and scheduled tasks. This all happens silently during normal WordPress execution.

Conditions required:

Plugin must be activated (automatic for updates to already-active plugins)

Where this breaks in practice:

Sites that downloaded but never activated (e.g., staging review) would not trigger the payload
Some hardened WordPress configurations use DISALLOW_FILE_MODS which may interfere with file writes

Detection/coverage: File integrity monitoring (OSSEC, Wazuh, Tripwire) would flag new files in wp-includes/, mu-plugins/, and .htaccess changes. WAFs with PHP upload rules may detect .cache file creation.

STEP 03

Persistent backdoor and C2 established

The malware communicates with rank1cdn[.]com for command-and-control. It registers system-level cron jobs (tagged #ms6v46) and hooks into WordPress page-load events to recreate its PHP backdoors if they are deleted. This self-healing mechanism means removing individual files without a full incident response leaves the server compromised.

Conditions required:

Outbound HTTP/HTTPS from web server to rank1cdn[.]com not blocked

Where this breaks in practice:

Egress filtering or DNS sinkholing of rank1cdn[.]com breaks C2 communication
However, local persistence (cron, SSH keys, admin accounts) survives even without C2

Detection/coverage: DNS/proxy logs for rank1cdn[.]com queries. Network IDS signatures for the C2 traffic pattern. Cron audit for #ms6v46 marker.

STEP 04

Credential harvesting and admin account creation

The malware creates unauthorized WordPress administrator accounts (username prefix wpsupport_, email domain @wp-mail.net), harvests database credentials from wp-config.php, and exfiltrates API keys and secrets accessible to the web server process. It also writes SSH authorized_keys entries for direct server access. At this point the attacker has full control of the WordPress application AND the underlying server.

Conditions required:

Steps 1-3 completed

Where this breaks in practice:

MFA on WordPress admin would not prevent the rogue account from being created but could limit its interactive use
SSH key injection requires the web server user to have write access to an SSH-authorized home directory, which is not universal

Detection/coverage: WordPress user audit for wpsupport_* accounts. SSH authorized_keys file monitoring. Database query for the three IOC wp_options keys.

STEP 05

Full server compromise and lateral movement risk

With database credentials, SSH access, and persistent PHP backdoors, the attacker can pivot to other services on the same server or network. Any secret the web server process could read — database passwords, SMTP credentials, payment gateway API keys, cloud provider tokens in environment variables — should be considered exfiltrated. The blast radius extends beyond WordPress to any co-hosted application or reachable internal service.

Conditions required:

Steps 1-4 completed
Server hosts additional services or has network access to internal resources

Where this breaks in practice:

Isolated single-purpose WordPress hosts limit lateral movement
Network segmentation between web tier and internal services constrains pivot options

Detection/coverage: Anomalous outbound connections from the web server. Unexpected SSH sessions. Database access from unusual source IPs.

03 · Compensating Control

CRITICAL 9.8→CRITICAL 9.8

Immediately audit all Rank Math PRO installations for the 11-hour update window — Query your WordPress fleet's plugin update logs, file timestamps on rank-math-pro/ directories, and hosting provider access logs to determine if any site downloaded v3.0.123 between Oct 15 20:02 UTC and Oct 16 07:12 UTC. This is the single most important triage step — it separates 'confirmed compromised' from 'not affected'. Per the noisgate mitigation SLA for CRITICAL, complete this within 3 days (by Oct 23).

CRITICAL 9.8→HIGH 8.0

SEVERITY REDUCED

Block rank1cdn[.]com at DNS and egress firewall — Sinkhole or blackhole the C2 domain rank1cdn[.]com at your DNS resolver and block it at the egress firewall/proxy. This severs the attacker's command channel. Deploy within hours. Note: this does NOT remove local persistence artifacts (cron, SSH keys, admin accounts, PHP backdoors), so residual severity remains HIGH.

CRITICAL 9.8→CRITICAL 9.8

Check IOCs on every Rank Math PRO host — On each WordPress server running Rank Math PRO, check: (1) wp_options table for keys _uf6qdn2hmm, t8krdk990phb, _np5pvf754c; (2) WordPress users table for wpsupport_* accounts or @wp-mail.net emails; (3) filesystem for wp-includes/class-wp-cache-util.php; (4) system crontab for #ms6v46; (5) SSH authorized_keys for unknown entries. Any hit means confirmed compromise. Deploy within 3 days per noisgate mitigation SLA.

CRITICAL 9.8→LOW 2.0

SEVERITY REDUCED

Restore confirmed-compromised hosts from pre-Oct-15 backup — For any server confirmed compromised, the only reliable remediation is a full restore from a backup taken before Oct 15, 2026. The self-restoring backdoor, multiple persistence mechanisms, and potential credential exfiltration make surgical cleanup unreliable. After restore, install Rank Math PRO v3.0.124 (clean), rotate ALL credentials (WordPress admin passwords, database passwords, API keys, SMTP credentials, cloud tokens), and invalidate all active sessions. This is the remediation action — target completion within the noisgate remediation SLA of 90 days for CRITICAL, but realistically this should be done within days given active exploitation.

CRITICAL 9.8→MEDIUM 5.0

SEVERITY REDUCED

Rotate all credentials accessible to the compromised web server — Even after restoration, assume that every credential the PHP process could read has been exfiltrated: database passwords, wp-config.php secrets, payment gateway API keys, SMTP credentials, cloud provider tokens in environment variables, and any connected SaaS API keys. Rotate all of them. If the database server was shared, assume those credentials are burned too. Deploy within 3 days.

What doesn't work

Updating to Rank Math PRO v3.0.124 alone — this replaces the plugin files but does NOT remove persistent backdoors in mu-plugins, fake core files, rogue admin accounts, cron jobs, SSH keys, or .htaccess modifications. The server remains fully compromised.
WordPress security plugins (Wordfence, Sucuri) scanning after the fact — while they can detect IOCs, the self-restoring backdoor may regenerate faster than a scan-and-delete cycle. These tools are useful for *detection* but not sufficient for *remediation* without a full restore.
WAF rules — the malware was delivered through the legitimate plugin update channel, not via a web attack. WAF rules cannot retroactively prevent a supply-chain compromise that already executed. They may block some C2 callbacks but not local persistence.
Simply deactivating the plugin — deactivation does not execute uninstall hooks for the malicious code, and the persistence mechanisms (cron, SSH keys, mu-plugins, fake core files) operate independently of the Rank Math plugin's activation state.

04 · Intelligence Metadata

The supporting signals.

In-the-Wild Status	Actively exploited. This is not a theoretical vulnerability — the malware was distributed via the vendor's own infrastructure and executed on sites that updated during the Oct 15-16 window. SecurityOnline and SecurityWeek confirm active compromise.
PoC / Exploit Availability	No separate PoC is needed or applicable. The trojanized plugin package is the exploit. The malware was embedded directly in distributed plugin files. No public exploit repos on GitHub target this CVE because the attack vector is the supply chain, not a remotely exploitable flaw.
EPSS Score	Not yet calculated — CVE was disclosed Oct 19, 2026; FIRST.org EPSS pipeline has not yet scored it. Given the supply-chain nature (not a remotely triggerable bug), EPSS may not accurately model this risk.
CISA KEV Status	Not listed as of Oct 20, 2026. Given confirmed active exploitation, KEV addition is likely imminent.
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` — 9.8. The vector reflects that no authentication or interaction is needed beyond installing/updating the plugin, and impact is total across C/I/A. For a supply-chain compromise, this vector is reasonable.
Affected Versions	Only Rank Math SEO PRO v3.0.123 packages downloaded between Oct 15, 2026 20:02 UTC and Oct 16, 2026 07:12 UTC. Free Rank Math (WordPress.org) is unaffected. v3.0.123 packages obtained outside the window are clean.
Fixed Version	Rank Math SEO PRO v3.0.124. However, upgrading only replaces the plugin — it does not remediate persistent backdoors, rogue accounts, cron jobs, SSH keys, or exfiltrated credentials.
Install Base / Exposure	Rank Math has 4M+ active installations (free + PRO combined). The PRO tier is a fraction of this — estimated tens to hundreds of thousands of sites. The 11-hour window further narrows the affected population, but the exact number of trojanized downloads is undisclosed.
C2 and IOCs	C2 domain: `rank1cdn[.]com`. wp_options keys: `_uf6qdn2hmm`, `t8krdk990phb`, `_np5pvf754c`. Rogue admin pattern: `wpsupport_*` / `@wp-mail.net`. Fake core file: `wp-includes/class-wp-cache-util.php`. Cron marker: `#ms6v46`. Malicious code signatures: `base64_decode` + XOR using key `xmmqhn`, `proc_open`, PHP-FPM socket ops.
Discovery / Attribution	Discovered and reported by Wordfence (Defiant, Inc.). Assigned CVE-2026-111862. Rank Math acknowledged the compromise and released v3.0.124 same day. Attack attribution is unknown; the method of initial supply-chain compromise has not been publicly disclosed.

Sources.

05 · The Call

Final Verdict

= UNCHANGED to CRITICAL (9.8/10)

Why this verdict

Supply-chain compromise = pre-authenticated code execution. The malware shipped inside a trusted vendor update channel. No exploit chain needed — the victim's normal update workflow delivers the payload. This bypasses every perimeter control, WAF, and authentication gate.
Multi-layered persistence defeats simple remediation. Self-restoring PHP backdoors, system cron jobs, SSH authorized_keys, rogue admin accounts, and mu-plugins backdoors mean that updating to v3.0.124 alone leaves the server fully compromised. This is an incident, not a patch cycle.
Credential exfiltration extends blast radius beyond WordPress. Database credentials, API keys, SMTP secrets, and cloud tokens accessible to the web server process should all be considered compromised. Lateral movement to co-hosted services, payment systems, or cloud accounts is realistic.
Role multiplier: WordPress with Rank Math PRO spans the deployment spectrum — from personal blogs (low value) to enterprise e-commerce, media properties, and marketing sites handling PII, payment data, and cloud integrations (high value). For enterprise WordPress deployments, this plugin runs on the production web tier, which is a (b)/(c) role: compromise yields database access, customer PII, payment gateway credentials, and potentially cloud IAM tokens. The blast radius is host-to-tenant scale. While WordPress+SEO-plugin is not a canonical high-value-role component like a DC or hypervisor, the supply-chain delivery mechanism and full server compromise on the production web tier floor this at HIGH minimum, and the confirmed active exploitation with self-restoring persistence pushes it to CRITICAL.
Confirmed active exploitation. This is not theoretical — the malware was distributed and executed. Sites that updated during the window are already compromised. This alone floors the verdict at the vendor's CRITICAL rating.

Why not higher?

The CVSS 9.8 is already near-maximum. A 10.0 would require Scope:Changed (S:C), meaning the vulnerability breaks out of its security scope to affect other components. While lateral movement is possible, the CVSS vector's S:U is technically correct since the compromise stays within the web server's existing privilege boundary. The score cannot meaningfully go higher.

Why not lower?

Despite the narrow 11-hour window and PRO-only scope limiting the *population* of affected sites, any site that did update is fully and persistently compromised with confirmed active exploitation. The self-restoring backdoor mechanism, credential theft, SSH key injection, and multi-layer persistence make this a genuine critical-severity incident for affected hosts. Population narrowing reduces the *probability* of any given Rank Math user being affected, but does not reduce the *impact* for those who are. Supply-chain compromises warrant maximum urgency because they exploit trust relationships that defenders cannot easily verify retroactively.

06 · Verification

Crowdsourced verification payload.

Run this script on each WordPress server that has Rank Math PRO installed. Execute as a user with read access to the WordPress installation directory and the system crontab. Usage: sudo bash rankmath_check.sh /var/www/html (pass your WordPress root path as the first argument). Requires wp-cli for database checks; filesystem checks work without it.

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/usr/bin/env bash\n# rankmath_check.sh — CVE-2026-111862 Rank Math PRO supply-chain IOC checker\n# Usage: sudo bash rankmath_check.sh /path/to/wordpress\n# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN\n\nset -euo pipefail\n\nWP_ROOT=\"${1:-}\"\nif [ -z \"$WP_ROOT\" ] || [ ! -d \"$WP_ROOT\" ]; then\n  echo \"[ERROR] Usage: $0 /path/to/wordpress\"\n  exit 2\nfi\n\nVULN=0\necho \"=== CVE-2026-111862 IOC Check ==\"\necho \"WordPress root: $WP_ROOT\"\necho \"\"\n\n# 1. Check if Rank Math PRO is installed\nRM_DIR=\"$WP_ROOT/wp-content/plugins/seo-by-rank-math-pro\"\nif [ ! -d \"$RM_DIR\" ] && [ ! -d \"$WP_ROOT/wp-content/plugins/rank-math-pro\" ]; then\n  echo \"[INFO] Rank Math PRO not found. Site not affected.\"\n  echo \"PATCHED\"\n  exit 0\nfi\n\n# Try alternate directory name\nif [ -d \"$WP_ROOT/wp-content/plugins/rank-math-pro\" ]; then\n  RM_DIR=\"$WP_ROOT/wp-content/plugins/rank-math-pro\"\nfi\necho \"[INFO] Rank Math PRO found at: $RM_DIR\"\n\n# 2. Check for fake core file\nFAKE_CORE=\"$WP_ROOT/wp-includes/class-wp-cache-util.php\"\nif [ -f \"$FAKE_CORE\" ]; then\n  echo \"[CRITICAL] Fake core file detected: $FAKE_CORE\"\n  VULN=1\nelse\n  echo \"[OK] No fake core file at $FAKE_CORE\"\nfi\n\n# 3. Check for malicious mu-plugins\nMU_DIR=\"$WP_ROOT/wp-content/mu-plugins\"\nif [ -d \"$MU_DIR\" ]; then\n  SUSPECT_MU=$(find \"$MU_DIR\" -name '*.php' -newer \"$MU_DIR\" -mtime -7 2>/dev/null | head -20)\n  if [ -n \"$SUSPECT_MU\" ]; then\n    echo \"[WARNING] Recently modified PHP files in mu-plugins:\"\n    echo \"$SUSPECT_MU\"\n  fi\nfi\n\n# 4. Check for malicious code signatures\necho \"\"\necho \"--- Scanning for malicious code signatures ---\"\nif grep -rl 'xmmqhn' \"$WP_ROOT/wp-content/\" \"$WP_ROOT/wp-includes/\" 2>/dev/null; then\n  echo \"[CRITICAL] Malicious XOR key 'xmmqhn' found in files above\"\n  VULN=1\nelse\n  echo \"[OK] No 'xmmqhn' signature found\"\nfi\n\n# 5. Check .htaccess for .cache PHP execution\nHTACCESS=\"$WP_ROOT/.htaccess\"\nif [ -f \"$HTACCESS\" ] && grep -q '\\.cache' \"$HTACCESS\"; then\n  echo \"[CRITICAL] .htaccess contains .cache execution rule\"\n  VULN=1\nelse\n  echo \"[OK] .htaccess clean of .cache rules\"\nfi\n\n# 6. Check system cron for marker\nif crontab -l 2>/dev/null | grep -q '#ms6v46'; then\n  echo \"[CRITICAL] System cron contains #ms6v46 marker\"\n  VULN=1\nelse\n  echo \"[OK] No #ms6v46 cron marker found\"\nfi\n# Also check www-data or web user cron\nfor WEBUSER in www-data nginx apache http; do\n  if crontab -u \"$WEBUSER\" -l 2>/dev/null | grep -q '#ms6v46'; then\n    echo \"[CRITICAL] Cron for $WEBUSER contains #ms6v46 marker\"\n    VULN=1\n  fi\ndone\n\n# 7. Check wp_options via wp-cli if available\nif command -v wp &>/dev/null; then\n  echo \"\"\n  echo \"--- Checking wp_options for IOC keys ---\"\n  for KEY in _uf6qdn2hmm t8krdk990phb _np5pvf754c; do\n    VAL=$(wp option get \"$KEY\" --path=\"$WP_ROOT\" 2>/dev/null || true)\n    if [ -n \"$VAL\" ]; then\n      echo \"[CRITICAL] Malicious wp_options key found: $KEY\"\n      VULN=1\n    else\n      echo \"[OK] wp_options key $KEY not present\"\n    fi\n  done\n  echo \"\"\n  echo \"--- Checking for rogue admin accounts ---\"\n  ROGUE=$(wp user list --role=administrator --field=user_login --path=\"$WP_ROOT\" 2>/dev/null | grep '^wpsupport_' || true)\n  if [ -n \"$ROGUE\" ]; then\n    echo \"[CRITICAL] Rogue admin account(s) found: $ROGUE\"\n    VULN=1\n  else\n    echo \"[OK] No wpsupport_* admin accounts found\"\n  fi\nelse\n  echo \"\"\n  echo \"[WARNING] wp-cli not found. Skipping database IOC checks.\"\n  echo \"  Install wp-cli and re-run, or manually check wp_options for:\"\n  echo \"    _uf6qdn2hmm, t8krdk990phb, _np5pvf754c\"\n  echo \"  And check users table for wpsupport_* accounts\"\nfi\n\n# 8. Check SSH authorized_keys for unexpected entries\necho \"\"\nfor HOMEDIR in /root /home/*; do\n  AK=\"$HOMEDIR/.ssh/authorized_keys\"\n  if [ -f \"$AK\" ]; then\n    RECENT=$(find \"$AK\" -mtime -7 2>/dev/null)\n    if [ -n \"$RECENT\" ]; then\n      echo \"[WARNING] Recently modified authorized_keys: $AK — review manually\"\n    fi\n  fi\ndone\n\necho \"\"\necho \"=== RESULT ===\"\nif [ \"$VULN\" -eq 1 ]; then\n  echo \"VULNERABLE — Server shows IOCs for CVE-2026-111862. Treat as fully compromised.\"\n  exit 1\nelse\n  echo \"PATCHED — No IOCs detected. Verify update timestamps to confirm v3.0.123 was not installed during the Oct 15-16 window.\"\n  exit 0\nfi