What Happened
The Hacker News reports copies of Rank Math PRO downloaded or updated between 20:02 UTC on October 15 and 07:12 UTC on October 16 carried malware. The affected build is 3.0.123. Wordfence assigned CVE-2026-111862 with a 9.8 rating. The backdoor rebuilds itself on each site visit, so deleting files alone fails. It places PHP shells in other plugin and theme folders, creates administrator accounts, edits .htaccess, and adds scheduled tasks and SSH keys. Rank Math published version 3.0.124, which replaces the plugin but removes none of this.
Why This Matters for Canadian Organizations
Small businesses, clinics, municipalities, and nonprofits across Canada run WordPress with premium plugins. Many have no security team to read a vendor notice. This is at least the third premium WordPress plugin update channel compromise in 2026. A hijacked site exposes stored customer data, payment and SMTP keys, and database credentials. Under PIPEDA, an organization holding personal information on the site must assess whether the breach poses a real risk of significant harm.
What to Do
Check the install date of Rank Math PRO. If the site received 3.0.123 in the window, restore a backup from before 20:02 UTC on October 15. Without a clean backup, delete the whole plugin folder, remove the wp_options entries _uf6qdn2hmm, t8krdk990phb, and _np5pvf754c, and block rank1cdn.com. Hunt for administrator names starting with wpsupport_. Rotate every credential the site reached. Read more in our TechTalk coverage.
