Rank Math says some paid copies of Rank Math PRO 3.0.123, downloaded or updated from rankmath.com between 20:02 UTC on 15 October and 07:12 UTC on 16 October 2026, contained malware. Wordfence scored the incident CVE-2026-111862 at 9.8. A site that activated one of those copies should be treated as compromised. Installing the clean release, 3.0.124, does not undo what the malware already did.

What happened

Rank Math published the notice on 16 October and pulled the bad packages. The free Rank Math SEO plugin on WordPress.org is not named in the notice. A 3.0.123 file obtained before the window, or never installed, is outside the vendor's confirmed scope. Version number alone is not proof of infection.

If the package was installed and activated, Rank Math says the malware can rebuild a hidden backdoor when someone visits the site. It can also leave extra PHP files, unknown administrator accounts, a fake WordPress core file, scheduled tasks, and changes that let .cache files run as PHP. Wordfence's record says secrets the web server can read may have been exposed, including database credentials and API keys. The malware is described as contacting rank1cdn.com.

Who is affected

Only the paid PRO plugin, and only copies taken from rankmath.com during that window.

• Sites that installed and activated Rank Math PRO 3.0.123 between 20:02 UTC on 15 October and 07:12 UTC on 16 October.
• Sites that auto-updated to that package in the same window and then activated it.
• Hosting accounts where that site could read database passwords, SMTP credentials, or payment keys.

What to do now

If you activated a copy from that window, restore the site and database from a backup taken before 20:02 UTC on 15 October, then rotate every secret the site could reach.

• Confirm the installed Rank Math PRO version and whether an update landed inside the window. The free plugin on WordPress.org is not in scope.
• Restore files and the database from a backup made before the window, then install 3.0.124 from your Rank Math account, not from an email link.
• If you cannot restore, delete the plugin folder, remove the malicious database options Rank Math lists, and have a host or security firm hunt for extra PHP files, unknown admins, and cron jobs. Updating alone is not a cleanup.
• Change WordPress, database, hosting, FTP, and API credentials. Regenerate the salts in wp-config.php. Block outbound connections to rank1cdn.com if the host can do it.
• Watch for removed files coming back. Rank Math says the backdoor can rebuild itself on a page visit if the rebuild mechanism is still in place.

What this means for South African businesses

A lot of local company and brochure sites run WordPress, and a paid SEO plugin is a normal install, not an edge case. The real risk is not the plugin version string. It is that an automatic update from the vendor's own site can plant a backdoor, and that a later clean update leaves the backdoor in place. For a small business, the practical test is simple: if the site updated Rank Math PRO on the evening of 15 October or the morning of 16 October SAST, assume the worst until a pre-window backup is restored.

Primary source: Rank Math PRO 3.0.123 security incident.