Official distributions and updates of Rank Math PRO served between October 15 and 16 contained malicious code, tracked as CVE-2026-111862 with a 9.8 severity score.
While updating to version 3.0.124 replaces the plugin, it does not remove persistent backdoors, unauthorized admin accounts, or cron tasks left on the server.
Who is affected?
The issue only affects the paid version of the plugin, which is purchased and updated directly from its creators' website and not from the official WordPress repository. The free version of the same plugin is not affected by the incident.
Those who downloaded or updated the add-on between 20:02 UTC on October 15 and 07:12 UTC on October 16 are affected by the issue. Security researchers reported that the attack targeted the systems of the add-on's own development company, while the identity of the researcher remains unknown.
What does malicious code cause?
Code embedded in the files can allow the website to be compromised. The attackers may have left hidden files in folders of other plugins or themes, created new administrator accounts, changed settings, and left backdoors open.
READ ALSO
Former OpenAI employee accused of planting hidden recording device
The recovery process
The add-on's creators removed the problematic files and released a clean version, 3.0.124. However, simply installing the new version is not enough to clean up an already compromised website, as it does not remove accounts or files created elsewhere.
The recommended solution is to restore an older clean backup from a time before October 15th at 20:02 UTC, run security checks, change all login details, and only then install the new version.
In cases where a clean backup is not available, manual cleaning is required which includes deleting the add-on folder, removing specific data, and blocking connections to the address associated with the attack.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)