{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/rank-math/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:rankmath:seo_pro:3.0.123:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-111862"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Rank Math SEO PRO (version 3.0.123)"],"_cs_severities":["critical"],"_cs_tags":["supply-chain","wordpress","cve-2026-111862","backdoor"],"_cs_type":"advisory","_cs_vendors":["Rank Math"],"content_html":"\u003cp\u003eA supply-chain compromise affected Rank Math SEO PRO version 3.0.123 for WordPress. Packages downloaded or updated between October 15, 2026 (20:02 UTC) and October 16, 2026 (07:12 UTC) were found to contain malicious code. The compromise allows attackers to establish persistent access, exfiltrate sensitive site secrets, and manipulate site configuration.\u003c/p\u003e\n\u003cp\u003eDefenders must identify the presence of unauthorized administrative accounts, malicious files within the WordPress core, PHP-executable files within cache directories, and specific entries within the WordPress options table. Rank Math has released version 3.0.124 as a clean replacement. Organizations that deployed the affected package during the specified window are advised to treat the underlying server and WordPress environment as fully compromised.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains unauthorized access to the distribution channel and injects malicious code into the Rank Math SEO PRO 3.0.123 plugin package.\u003c/li\u003e\n\u003cli\u003eThe malicious package is downloaded or updated onto target WordPress installations via the standard plugin management interface.\u003c/li\u003e\n\u003cli\u003eMalware activates upon plugin initialization and execution within the web server environment.\u003c/li\u003e\n\u003cli\u003eThe malware creates hidden PHP backdoors and modifies WordPress core files to ensure persistence.\u003c/li\u003e\n\u003cli\u003eThe payload establishes communication with the C2 domain rank1cdn[.]com for instructions.\u003c/li\u003e\n\u003cli\u003eThe malware harvests WordPress credentials, database credentials, and API keys stored in the web server environment.\u003c/li\u003e\n\u003cli\u003eThe malware creates unauthorized administrative accounts or adds malicious keys to the 'wp_options' table to maintain control.\u003c/li\u003e\n\u003cli\u003eThe attacker executes arbitrary commands and exfiltrates data from the compromised environment.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe compromise provides attackers with full administrative control over affected WordPress sites. Impacted organizations are at risk of data exfiltration (including database contents and configuration secrets), unauthorized site modifications, and persistent unauthorized access. Sites that activated the affected package are considered fully compromised, necessitating a complete forensic audit and security credential rotation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify any WordPress site that installed or updated the Rank Math SEO PRO plugin during the window of October 15, 2026 (20:02 UTC) through October 16, 2026 (07:12 UTC).\u003c/li\u003e\n\u003cli\u003eUpgrade to Rank Math SEO PRO version 3.0.124 or later immediately.\u003c/li\u003e\n\u003cli\u003eSearch for unauthorized administrative users in the WordPress database and audit the \u003ccode\u003ewp_options\u003c/code\u003e table for unexpected keys associated with the plugin incident.\u003c/li\u003e\n\u003cli\u003eScan file systems for hidden PHP backdoors, fake WordPress core files, and files with a \u003ccode\u003e.cache\u003c/code\u003e extension that contain PHP code.\u003c/li\u003e\n\u003cli\u003eBlock traffic to \u003ccode\u003erank1cdn.com\u003c/code\u003e at the network perimeter (firewall/DNS).\u003c/li\u003e\n\u003cli\u003eRotate all credentials accessible to the web server, including database passwords, WordPress admin accounts, and API keys.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T18:08:20Z","date_published":"2026-10-19T18:08:20Z","id":"https://feed.craftedsignal.io/briefs/2026-10-rank-math-supply-chain/","summary":"A supply-chain compromise of Rank Math SEO PRO version 3.0.123, distributed between October 15 and 16, 2026, introduced a backdoor enabling persistent access, credential theft, and unauthorized administrative control.","title":"Supply Chain Compromise of Rank Math SEO PRO WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-rank-math-supply-chain/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Rank Math PRO (3.0.123)"],"_cs_severities":["high"],"_cs_tags":["supply-chain","wordpress","plugin-compromise"],"_cs_type":"advisory","_cs_vendors":["Rank Math"],"content_html":"\u003cp\u003eBetween October 15 and October 16, 2026, attackers successfully compromised the supply chain for the Rank Math PRO WordPress plugin, specifically version 3.0.123. Users who downloaded or updated to this version during the window (20:02 UTC on October 15 to 07:12 UTC on October 16) received packages containing malicious code. Once activated, the malware grants attackers persistent administrative access, the ability to exfiltrate credentials and API keys, and creates backdoors within the compromised WordPress environment. The persistence mechanisms are multifaceted, including database modifications, fake core files, and .htaccess manipulations, making manual remediation complex. This incident underscores the risks inherent in third-party plugin updates and the potential for broad, automated compromise via supply chain vectors.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker compromises the build or distribution channel of Rank Math PRO version 3.0.123.\u003c/li\u003e\n\u003cli\u003eVictim administrator downloads or updates the plugin during the period of compromise.\u003c/li\u003e\n\u003cli\u003eActivation of the malicious plugin allows for initial execution of embedded PHP scripts.\u003c/li\u003e\n\u003cli\u003eMalware drops malicious .cache files containing PHP payloads and injects fake WordPress core files.\u003c/li\u003e\n\u003cli\u003eThe attacker modifies .htaccess files to ensure .cache files are executed as PHP code upon page visits.\u003c/li\u003e\n\u003cli\u003eMalware creates a hidden backdoor, registers persistent tasks or cron jobs, and creates unauthorized administrator accounts.\u003c/li\u003e\n\u003cli\u003eAttacker exfiltrates sensitive data including API keys, database credentials, and site secrets.\u003c/li\u003e\n\u003cli\u003ePersistent access is maintained across page loads and potential site updates via the deployed backdoors.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eVictims of this compromise face a total takeover of their WordPress websites. The malware enables the exfiltration of sensitive site data, including credentials and API keys, and establishes deep persistence that survives typical plugin removal. Impacted users must perform a full site restoration from a clean backup to ensure the removal of attacker-controlled backdoors, cron jobs, and unauthorized administrative users.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eImmediately verify the version of the Rank Math PRO plugin and update to version 3.0.124 or later if running 3.0.123.\u003c/li\u003e\n\u003cli\u003eBlock outbound traffic to the known attacker domain 'rank1cdn.com' at the network perimeter.\u003c/li\u003e\n\u003cli\u003eConduct a forensic review of the web server for unauthorized PHP files, modifications to .htaccess files, and unrecognized scheduled cron jobs.\u003c/li\u003e\n\u003cli\u003eAudit the WordPress administrative user list for unauthorized accounts created during or after the compromise window.\u003c/li\u003e\n\u003cli\u003eForce a password reset for all administrative users and rotate all API keys and secrets stored within the WordPress environment.\u003c/li\u003e\n\u003cli\u003eRestore the entire website from a known-clean backup created prior to October 15, 2026, as manual cleanup may be incomplete.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-19T16:19:10Z","date_published":"2026-10-19T16:19:10Z","id":"https://feed.craftedsignal.io/briefs/2026-10-rank-math-compromise/","summary":"Attackers compromised Rank Math PRO version 3.0.123 between October 15 and October 16, 2026, injecting malware that provides persistent administrative access, credential theft, and server-side backdoor capabilities.","title":"Supply Chain Compromise of Rank Math PRO WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-rank-math-compromise/"}],"language":"en","title":"CraftedSignal Threat Feed - Rank Math","version":"https://jsonfeed.org/version/1.1"}