Wordfence and the plugin vendor have confirmed that a build of Rank Math PRO — one of the most widely used WordPress SEO plugins — was trojanized at the source and served to customers' sites for roughly 11 hours, between 15 October 20:02 UTC and 16 October 07:12 UTC. Any site that auto-updated to version 3.0.123 during that window received a planted PHP backdoor alongside the real plugin files. The flaw is tracked as CVE-2026-111862, rated 9.8 out of 10.
The backdoor isn't a simple dropped file you can delete once. It regenerates itself on page load, so removing it without also removing its trigger leaves it able to come back. It phones home to a domain registered for the campaign (rank1cdn[.]com) and is capable of pulling WordPress, database, and API credentials off the compromised site. Rank Math told researchers the trojanized build reached "several hundred" PRO customers before it was pulled — the free, wordpress.org-listed version of the plugin was never touched.
What this means for your business
If your site runs Rank Math PRO, the first thing to check is not whether you're currently on a safe version — nearly everyone will be by now — but whether your site auto-updated during that specific 11-hour window on 15–16 October. Your host or developer can check this from the plugin update log or file-modification timestamps on the Rank Math directory. If the timing matches, treat the site as compromised, not just patched: updating to the current version removes the vulnerable code but does not remove a backdoor that's already been planted.
For a site in that window, the vendor's own advice is the safest path: restore from a clean backup taken before 15 October if you have one, rather than trying to hand-clean the infection. Either way, rotate every credential the site touches — WordPress admin passwords, database credentials, hosting panel logins, and any API keys Rank Math or other plugins store — and ask your host to check outbound traffic logs for connections to rank1cdn[.]com. If you manage this yourself and aren't confident distinguishing a clean reinstall from a persistent backdoor, that's exactly the kind of check worth having a second set of eyes on before you consider the matter closed.