CVE-2026-111862

Affected websites may suffer persistent unauthorized access, malicious PHP execution, unauthorized administrator-account creation, and modification of website or server resources accessible to the web server. WordPress passwords, database credentials, API keys, payment and email service credentials, and other accessible secrets must be considered potentially exposed. Malicious files, database entries, scheduled tasks, and other persistence can survive plugin replacement and recreate removed backdoors. Websites that activated an affected package should be treated as compromised even if subsequently updated.

Identify installations that obtained Rank Math SEO PRO during the affected distribution window and prevent activation of suspect packages. Restrict access to affected websites during containment and block outbound connections to the identified malware infrastructure where hosting or firewall controls permit. Investigate unauthorized administrator accounts, unexpected PHP files, malicious database entries, altered execution rules, scheduled tasks, and SSH persistence. Monitor outbound traffic and the reappearance of removed artifacts; absence of known indicators does not establish that a site is clean. A request-filtering rule is not a substitute for recovery from a compromised software distribution.

For websites that activated an affected package, restore both website files and the database from a verified clean backup predating October 15, 2026 at 20:02 UTC, inspect for persistence outside the restored website, scan the recovered environment, rotate potentially exposed credentials, and install clean version 3.0.124 from the vendor's authenticated distribution channel. If no suitable backup exists, use an experienced incident responder or hosting provider to perform ordered cleanup: delete the entire affected plugin directory rather than merely deactivating it, remove the three identified malicious database options, and then remove additional backdoors, unauthorized accounts, malicious execution rules, and scheduled persistence. Review server processes, SSH access, and writable locations outside the website; reinstall affected components from trusted sources where appropriate. Replace exposed passwords, database credentials, WordPress security keys and salts, API keys, and hosting and remote-access credentials, and review administrator two-factor authentication. Validate integrity and monitor for returning artifacts. For an affected package installed but never activated, delete its files, install version 3.0.124, and run a security scan. Updating alone is insufficient for an already compromised site.