Rank Math, a WordPress SEO plugin with a very large installed base, says its PRO build was distributed with a backdoor for about eleven hours: from 20:02 UTC on 15 October to 07:12 UTC on 16 October. The malicious build is 3.0.123. The clean replacement is 3.0.124. It is tracked as CVE-2026-111862, scored 9.8 by Wordfence.

The free version from WordPress.org is not affected. This was the paid update channel.

The version number does not answer the question

Here is what makes this one awkward in a way most supply-chain incidents are not.

A copy of 3.0.123 downloaded at 19:00 UTC on 15 October is clean. A copy of 3.0.123 downloaded at 21:00 UTC the same evening is backdoored. They report the same version string. The plugin list in the WordPress admin shows the same number. A fleet inventory, a management dashboard, a client report — all of them give you 3.0.123 and none of them distinguishes the two files.

So the first question anybody asks during an incident, what version am I running, is the wrong question here, and the right one is what time did this site pull its update. That is a question most people cannot answer from the admin interface at all. It lives in update logs, host logs or backup timestamps, if anywhere.

Patchstack notes that a mitigating rule is not possible for this, which removes the other usual fallback.

It puts itself back

The backdoor is described as self-restoring: it can recreate its hidden component when somebody visits the site. That is the property that turns a clean-up into a project.

And updating does not finish the job. Moving to 3.0.124 replaces the plugin files, which is necessary and is not sufficient, because the malware's other artefacts are not plugin files. Reporting on the vendor's guidance describes administrator accounts, scheduled tasks and additional files left behind by the compromise, none of which a plugin update touches.

Rank Math's own recommendation is the honest one and the expensive one: restore from a backup taken before 20:02 UTC on 15 October, then rotate credentials.

The window is the pattern now

This is the second update-channel compromise we have covered in a week where the exposure window was measured in hours rather than months. The other was AOMEI, where two text files on the vendor's update server were swapped for five to ten minutes at a time and the vendor's site looked clean to anyone who checked afterwards.

Eleven hours is long by that standard and still short by the standard of how organisations actually work. An update that lands on a Thursday evening and is corrected by Friday morning will be installed by every site with automatic updates enabled and by nobody who was waiting for a maintenance window.

Automatic updates are good advice. They are also, in this specific failure mode, the mechanism of infection, and the sites that were slow are the sites that are fine. That is uncomfortable and it is not an argument for turning them off: the base rate of harm from unpatched plugins is far higher than the base rate of poisoned ones.

What to do

  • Work out when each site last updated Rank Math PRO, not what version it reports. Host update logs, WordPress update history and backup timestamps are where that lives.
  • If a site pulled the update inside the window, treat it as compromised rather than as needing an update.
  • Restore from a backup predating 20:02 UTC on 15 October where you can. Rank Math says so, and it is the only step that removes what you cannot enumerate.
  • Rotate everything the site holds: administrator passwords, database credentials, API keys, and any salts or secrets in the configuration.
  • Audit administrator accounts and scheduled tasks after restoring, and compare them against a known-good list rather than against what looks reasonable.
  • Update to 3.0.124 regardless. It is the clean build.

What is not established

  • How the update channel was compromised. Rank Math has not published a root cause.
  • How many sites pulled the malicious build during the window.
  • What the backdoor did once established, beyond its ability to restore itself.
  • Whether the attacker used the access for anything on affected sites, or only planted it.
  • Whether any build other than 3.0.123 was affected at any point.
  • What the free version's exposure is, if any. The vendor says it is unaffected and that is the vendor's statement.