{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-111862/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:rankmath:seo_pro:3.0.123:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-111862"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Rank Math SEO PRO (version 3.0.123)"],"_cs_severities":["critical"],"_cs_tags":["supply-chain","wordpress","cve-2026-111862","backdoor"],"_cs_type":"advisory","_cs_vendors":["Rank Math"],"content_html":"\u003cp\u003eA supply-chain compromise affected Rank Math SEO PRO version 3.0.123 for WordPress. Packages downloaded or updated between October 15, 2026 (20:02 UTC) and October 16, 2026 (07:12 UTC) were found to contain malicious code. The compromise allows attackers to establish persistent access, exfiltrate sensitive site secrets, and manipulate site configuration.\u003c/p\u003e\n\u003cp\u003eDefenders must identify the presence of unauthorized administrative accounts, malicious files within the WordPress core, PHP-executable files within cache directories, and specific entries within the WordPress options table. Rank Math has released version 3.0.124 as a clean replacement. Organizations that deployed the affected package during the specified window are advised to treat the underlying server and WordPress environment as fully compromised.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains unauthorized access to the distribution channel and injects malicious code into the Rank Math SEO PRO 3.0.123 plugin package.\u003c/li\u003e\n\u003cli\u003eThe malicious package is downloaded or updated onto target WordPress installations via the standard plugin management interface.\u003c/li\u003e\n\u003cli\u003eMalware activates upon plugin initialization and execution within the web server environment.\u003c/li\u003e\n\u003cli\u003eThe malware creates hidden PHP backdoors and modifies WordPress core files to ensure persistence.\u003c/li\u003e\n\u003cli\u003eThe payload establishes communication with the C2 domain rank1cdn[.]com for instructions.\u003c/li\u003e\n\u003cli\u003eThe malware harvests WordPress credentials, database credentials, and API keys stored in the web server environment.\u003c/li\u003e\n\u003cli\u003eThe malware creates unauthorized administrative accounts or adds malicious keys to the 'wp_options' table to maintain control.\u003c/li\u003e\n\u003cli\u003eThe attacker executes arbitrary commands and exfiltrates data from the compromised environment.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe compromise provides attackers with full administrative control over affected WordPress sites. Impacted organizations are at risk of data exfiltration (including database contents and configuration secrets), unauthorized site modifications, and persistent unauthorized access. Sites that activated the affected package are considered fully compromised, necessitating a complete forensic audit and security credential rotation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify any WordPress site that installed or updated the Rank Math SEO PRO plugin during the window of October 15, 2026 (20:02 UTC) through October 16, 2026 (07:12 UTC).\u003c/li\u003e\n\u003cli\u003eUpgrade to Rank Math SEO PRO version 3.0.124 or later immediately.\u003c/li\u003e\n\u003cli\u003eSearch for unauthorized administrative users in the WordPress database and audit the \u003ccode\u003ewp_options\u003c/code\u003e table for unexpected keys associated with the plugin incident.\u003c/li\u003e\n\u003cli\u003eScan file systems for hidden PHP backdoors, fake WordPress core files, and files with a \u003ccode\u003e.cache\u003c/code\u003e extension that contain PHP code.\u003c/li\u003e\n\u003cli\u003eBlock traffic to \u003ccode\u003erank1cdn.com\u003c/code\u003e at the network perimeter (firewall/DNS).\u003c/li\u003e\n\u003cli\u003eRotate all credentials accessible to the web server, including database passwords, WordPress admin accounts, and API keys.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T18:08:20Z","date_published":"2026-10-19T18:08:20Z","id":"https://feed.craftedsignal.io/briefs/2026-10-rank-math-supply-chain/","summary":"A supply-chain compromise of Rank Math SEO PRO version 3.0.123, distributed between October 15 and 16, 2026, introduced a backdoor enabling persistent access, credential theft, and unauthorized administrative control.","title":"Supply Chain Compromise of Rank Math SEO PRO WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-rank-math-supply-chain/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-111862","version":"https://jsonfeed.org/version/1.1"}