Rank Math PRO 3.0.123 backdoored in a supply chain attack (CVE-2026-111862, Oct 15-16 2026): how do I check my WordPress site and clean it up?

What happened: attackers got into Rank Math's distribution and served a trojanized Rank Math SEO PRO 3.0.123 between October 15, 2026 20:02 UTC and October 16, 2026 07:12 UTC. Sites that installed or auto-updated to that build and activated it got a persistent backdoor that talks to rank1cdn[.]com, can recreate itself on page visits, add hidden admin users, and reach secrets the web server can read (wp-config.php database credentials, API keys) and, depending on server permissions, things like SSH keys and cron jobs. The incident is tracked as CVE-2026-111862 (CVSS 9.8). The free Rank Math plugin from WordPress.org was reported as not affected. The clean release is 3.0.124. Am I affected: - You run Rank Math PRO and it updated or was installed during that window (check the plugin version history, update logs, or file timestamps of wp-content/plugins/seo-by-rank-math-pro). - Indicators reported: a fake core file wp-includes/class-wp-cache-util.php, unknown admin accounts with usernames starting wpsupport_ or emails at wp-mail.net, unexpected database options (one reported name is _np5pvf754c), changes to .htaccess, PHP being run from .cache files, and outbound requests to rank1cdn[.]com. Fix: 1. Best option: restore the whole site (files and database) from a backup taken before October 15, 2026, then install Rank Math PRO 3.0.124 or later. 2. If there is no clean backup: delete the Rank Math PRO plugin folder, reinstall 3.0.124+ from Rank Math, remove the fake core file and malicious database entries, delete unknown admin users, reinstall WordPress core files, and scan for other added PHP files across wp-content and wp-includes. Because the backdoor regenerates, block rank1cdn[.]com outbound at the server or firewall during cleanup. 3. Check outside WordPress too: SSH authorized_keys, crontabs and unfamiliar processes for the web server's user. 4. Rotate everything the site could read: database password, WordPress salts and admin passwords, hosting/SFTP credentials, and API keys stored in plugins or wp-config.php. After: rescan with a WordPress security scanner, monitor for new admin users and file changes for a few weeks, and consider delaying automatic updates of premium plugins by a day so supply chain incidents are caught before they reach you. Sources: https://www.bleepingcomputer.com/news/security/wordpress-seo-plugin-rank-math-compromised-to-backdoor-websites/ https://www.securityweek.com/rank-math-pro-wordpress-plugin-compromised-in-supply-chain-attack/ https://www.scworld.com/brief/malicious-rank-math-pro-version-distributed-in-supply-chain-attack