--- title: "Rank Math SEO PRO Backdoor: The 11-Hour Window" description: "Rank Math confirmed malware in SEO PRO 3.0.123 packages from an 11-hour window in October 2026. [CVE-2026-111862](https://www.cve.org/CVERecord?id=CVE-2026-111862) scores 9.8 Critical. What the malware does, the indicators, and the compliance angle." url: https://policycortex.com/blog/rankmath-pro-supply-chain-backdoor sealed: 2026-10-23 register: blog/rankmath-pro-supply-chain-backdoor records: 3 digest: sha3:3b1a68a3659fb01519de1f5e78e6898a25d69c0de3b781445e2f3189cae7357f --- # Rank Math SEO PRO Backdoor: An 11-Hour Supply Chain Window Resources / Blog Rank Math confirmed a supply chain compromise in Rank Math SEO PRO 3.0.123. Packages downloaded or updated between October 15, 2026 20:02 UTC and October 16, 2026 07:12 UTC carried malware. Activate one and the site is compromised. Leonard Esere · Sealed 2026-10-23 · Reading time 5 min Filed under: [Rank Math](https://policycortex.com/blog/tags/rank-math), [supply chain](https://policycortex.com/blog/tags/supply-chain), [CVE](https://policycortex.com/blog/tags/cve), [NIST 800-171](https://policycortex.com/blog/tags/nist-800-171), [malware](https://policycortex.com/blog/tags/malware) **Summary** - [CVE-2026-111862](https://www.cve.org/CVERecord?id=CVE-2026-111862) scores 9.8 Critical. Rank Math confirmed a supply chain compromise in Rank Math SEO PRO 3.0.123. - Packages downloaded or updated between October 15, 2026 20:02 UTC and October 16, 2026 07:12 UTC carried the malware. The free WordPress.org edition was not affected. - Activating an affected package means treating the site as compromised. The malware keeps persistent access, beacons to rank1cdn[.]com, and exposes credentials and keys. - Clean version 3.0.124 is out. Recovery means restoring from a backup made before the window, or manual cleanup plus a full audit of admins, cron jobs, SSH keys, and secrets. ## The 11-hour window Rank Math confirmed a supply chain compromise in its PRO plugin. Rank Math SEO PRO 3.0.123 packages carried malware for 11 hours. The window ran from October 15, 2026 20:02 Coordinated Universal Time (UTC) to October 16, 2026 07:12 UTC. Any site that downloaded or updated inside the window is suspect. The free WordPress.org edition was not affected. The flaw is tracked as [CVE-2026-111862](https://www.cve.org/CVERecord?id=CVE-2026-111862). CVE stands for Common Vulnerabilities and Exposures. Its Common Vulnerability Scoring System (CVSS) score is 9.8, Critical. ## What the malware does once activated Activating an affected package means treating the website as compromised. The malware sets up persistent access to the site. It phones home to rank1cdn[.]com. It recreates hidden backdoors each time pages are visited. It can expose WordPress credentials and database credentials. It can also expose API keys, SSH keys, and other secrets the web server can reach. ## The indicators Rank Math listed Rank Math listed the indicators to check. Look for these on any host that ran the tainted package. - Three malicious wp_options rows, one named _np5pvf754c. - Hidden PHP backdoors in writable locations. - PHP-executable .cache files. - A fake core file at wp-includes/class-wp-cache-util.php. - A system cron marker left by the malware. - Rogue administrator accounts that begin with wpsupport_. ## What the vendor says to do Rank Math removed the affected files and released clean version 3.0.124. The vendor gives two recovery paths. One: restore files and the database from a backup made before October 15, 2026 20:02 UTC. Two: delete the rank-math-pro directory and remove the malicious wp_options rows. Then block outbound traffic to rank1cdn[.]com. Then audit administrator accounts, cron jobs, SSH keys, and writable locations. Pull your update logs and check the window first. ## Which compliance rules this touches NIST is the National Institute of Standards and Technology. Its 800-171 guidance has a 3.14 family for system and information integrity (SI). Practice 3.14.1 covers flaw remediation. Practice 3.14.2 covers malicious code protection. Practice 3.14.6 covers monitoring. This incident tests all three at once. DFARS is the Defense Federal Acquisition Regulation Supplement. Its clause 252.204-7012 can require a cyber incident report to DoD within 72 hours. It also requires keeping forensic images and logs for 90 days. Your SSP is the System Security Plan. It should inventory this plugin and its vendor update channel. If the plugin is not in the inventory, your response starts blind. ## What PolicyCortex does here PolicyCortex does not patch these products or clean compromised hosts. That work belongs to your IT team or your incident responders. PolicyCortex collects evidence from live Azure configuration and ties each control to the setting that met it. When your controls reference this incident, the evidence comes from the system itself, not from memory. ## Sources - [CVE-2026-111862](https://www.cve.org/CVERecord?id=CVE-2026-111862) record, CVE Program. - Rank Math SEO Pro 3.0.123 Malware, Wordfence. https://www.wordfence.com/blog/2026/10/rank-math-seo-pro-3-0-123-malware/ - Rank Math malware affected sites, Betanews. https://betanews.com/article/rank-math-malware-affected-sites/ - Rank Math vendor notice, rankmath.com. Authority for the compromise window and the indicator list. - Original diagram by PolicyCortex. **Questions on this record** **Q: Am I affected by the Rank Math compromise?** A: Only if you downloaded or updated Rank Math SEO PRO 3.0.123 between October 15, 2026 20:02 UTC and October 16, 2026 07:12 UTC. The free WordPress.org edition was not affected. **Q: Does updating to 3.0.124 clean my site?** A: No. The clean release removes the tainted package, but it does not remove planted backdoors or accounts. A site that activated the malware needs incident response. **Q: What secrets should I rotate after this?** A: WordPress credentials, database credentials, API keys, SSH keys, and any other secrets the web server could reach. The malware can expose all of them. ## Related records Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page. - **proof.state**: [Proof of State](https://policycortex.com/proof/state). What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained. - **proof.change**: [Proof of Change](https://policycortex.com/proof/change). Who or what altered the environment, under what authority, with before and after state hashes. - **proof.agency**: [Proof of Agency](https://policycortex.com/proof/agency). What a machine was permitted to do before it acted, what it did, and what would have stopped it. - **architecture**: [Architecture](https://policycortex.com/architecture). How the chain is built and where it lives: inside your tenant, with no egress of evidence. ### Further reading in this register | Published | Entry | Reading | |---|---|---| | 2026-10-22 | [Eight CA Keys Compromised: What the eMudhra Incident Teaches About Trust](https://policycortex.com/blog/emudhra-ca-compromise-certificate-trust): Private keys for eight eMudhra intermediate certificates were weak enough to recover from public data. Mozilla, Chrome, Apple, and Microsoft rushed to block them. The trust system worked this time. Your certificate inventory may not. | 5 min | | 2026-10-22 | [OVHcloud CLI Releases Were Swapped for a Secret Stealing Build](https://policycortex.com/blog/ovhcloud-cli-supply-chain-secrets): Advisory GHSA-862f-55f5-vmvw says a compromised developer account replaced OVHcloud CLI release binaries for 94 minutes on October 19, 2026. About 250 downloads happened. Rotate secrets if you downloaded then. | 5 min | | 2026-10-22 | [Stolen Keys, Signed Commands: The UpdraftCentral Supply Chain Backdoor](https://policycortex.com/blog/updraftcentral-key-compromise-supply-chain): Attackers stole TeamUpdraft's UpdraftCentral keys and pushed backdoors to WordPress sites as properly signed commands. No plugin flaw was needed. Patchstack rates the impact 9.8. | 5 min | Verify the record this entry describes. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book) Dates of record - **Published**: 2026-10-23 - **Last updated**: Unchanged since sealing - **Author**: Leonard Esere - **Record**: https://policycortex.com/blog/rankmath-pro-supply-chain-backdoor ## Register colophon | Seq | Label | SHA3-256 | Prev | |---|---|---|---| | REC 0000 | HEAD | 583df42112b9 | 8f62b8bb15a0 | | REC 0001 | BODY | 260cdd347c68 | 583df42112b9 | | REC 0002 | RELATED RECORDS | 3b1a68a3659f | 260cdd347c68 | Head sha3:3b1a68a3659fb01519de1f5e78e6898a25d69c0de3b781445e2f3189cae7357f. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.