Plugin updates are supposed to be the boring, responsible part of running WordPress. You click the button, have some coffee, and your site ends up safer than before. For anyone who pulled a bad Rank Math SEO PRO 3.0.123 package last week, that button installed a backdoor instead.
Eleven Hours, One Very Bad Build
Attackers modified a subset of Rank Math SEO PRO 3.0.123 distribution packages. The compromise is tracked as CVE-2026-111862, is rated CVSS 9.8, and is being actively exploited. The malicious window ran from October 15, 2026 at 20:02 UTC to October 16 at 07:12 UTC. Rank Math has removed the tainted packages and shipped 3.0.124 as a clean replacement.
The payload is thorough. It activates when an administrator activates the affected plugin, phones home to rank1cdn[.]com, and recreates hidden PHP backdoors during normal page visits. It also creates rogue administrator accounts, plants a fake WordPress core file, drops PHP-executable .cache files, and registers a cron marker. It also collects WordPress credentials, database passwords, and API keys.
"Fully Compromised" Is the Official Wording
Rank Math's guidance is blunt: anyone who activated an affected package during the window should "treat their website as fully compromised." Updating to 3.0.124 removes the bad code, but that's only the start. You also need to check for three malicious wp_options keys, unknown admin users, unexpected .cache files, and unauthorized cron jobs. Then rotate every database and API credential the site has used. Running 3.0.123 outside that window doesn't mean you were hit, so check timestamps before you panic.
Here's the bigger point. Most of us treat vendor packages as trusted because they come from a vendor we already trust. Supply-chain attacks exploit exactly that, and no web application firewall can stop a malicious update you installed yourself. Defending against them comes down to boring habits: pinned versions, staged rollouts, file-integrity monitoring, and short-lived credentials. Malware that harvests API keys turns one infected site into a problem for every service those keys open.
The fastest way into a website isn't breaking down the door. It's getting a copy of the key cut by someone you trust.
If this one made you nervous about blindly auto-updating, our free developer's checklist for defending against supply-chain attacks walks through the habits that would have contained this kind of breach.