Supply-chain attacksBriefConfirmed by two or more outlets
Rank Math PRO WordPress plugin backdoor
3.0.123 served a self-restoring backdoor for about 11 hours.
- Disclosed
What happened
- 3.0.123 served a self-restoring backdoor for about 11 hours. Fixed: 3.0.124 (CVE-2026-111862 per one source).
Live scores
Live scores
CVE-2026-111862- EPSS
- 0.007
low predicted chance of attack - VEDAS
- 0.056
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- None yet
Sources
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.