A supply‑chain compromise inserted malicious code into Rank Math SEO PRO version 3.0.123 during a narrow update window. When the compromised plugin is activated, an attacker can establish persistence, communicate with external command servers, create hidden PHP backdoors, inject unauthorized administrator accounts, modify core files, and exfiltrate WordPress credentials, database secrets, and API keys. The malware also suppresses normal site operation by rewriting cron markers and manipulating cache files, effectively enabling full control of the affected WordPress installation.

Only installations of Rank Math SEO PRO that were downloaded or updated between October 15, 2026 20:02 UTC and October 16, 2026 07:12 UTC are compromised. The issue is confined to the specific plugin packages within that time frame; other versions or installations outside the window are not known to be affected.

The CVSS score of 9.8 indicates a critical severity. No EPSS value is available and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is the normal WordPress plugin installation or update process; an attacker does not need additional credentials once the plugin is activated. Given the high score and the functional impact, the risk of exploitation is significant and an immediate response is warranted.