---
title: Rank Math SEO PRO 3.0.123 shipped with malware for 11 hours (CVE-2026-111862, CVSS 9.8); activated sites should be treated as compromised | ctxsec
url: https://ctxsec.com/items/rank-math-seo-pro-3-0-123-malware
description: ""
status: "confirmed (vendor via Wordfence; CVE-2026-111862)"
published: 2026-10-17
---

> 

[← Cybersecurity News](/news) · [markdown](/items/rank-math-seo-pro-3-0-123-malware.md)

confirmed (vendor via Wordfence; CVE-2026-111862)

2026-10-17

### Rank Math SEO PRO 3.0.123 shipped with malware for 11 hours (CVE-2026-111862, CVSS 9.8); activated sites should be treated as compromised

Wordfence relays Rank Math's notice that some SEO PRO 3.0.123 packages downloaded or auto-updated between 20:02 UTC Oct 15 and 07:12 UTC Oct 16 contained malware. If activated, it can keep persistent access, talk to rank1cdn[.]com, recreate hidden backdoors on page visits, add admin accounts and cron jobs, and expose WordPress, database and API secrets. 3.0.124 is clean, but updating alone doesn't remove what the malware planted. Only the paid PRO add-on is named; 3.0.123 obtained outside the window isn't claimed as affected.

Sources: [Wordfence PSA (CVE-2026-111862)](https://www.wordfence.com/blog/2026/10/rank-math-seo-pro-3-0-123-malware/)