CVE-2026-111862: Rank Math PRO WordPress plugin shipped a booby-trapped update for eleven hours

Not listed so far in CISA’s catalog of actively exploited vulnerabilities.

Our analyses

Rank Math PRO WordPress plugin shipped a booby-trapped update for eleven hours

This SEO plugin distributed a backdoor on October 15 and 16. Any site that activated the compromised version should be considered compromised: here is how to check and clean up.

Oct 19, 20262 min read

What to do

Check whether your estate includes the affected product, including internet-facing devices.
Apply the vendor’s patch or mitigations (references below).
Watch for exploitation: this entry is updated if the vulnerability enters the exploited catalog or is the subject of a CERT-FR alert.

References

NVD entry (NIST)