Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor

{"

Malware Details and Impact":"The malware in the Rank Math PRO plugin can recreate a hidden backdoor, exposing sensitive data such as passwords, database credentials, and API keys. The attacker may also have left PHP backdoor files in other plugins' folders, in theme folders, and in the must-use plugins directory.","

Recovery Steps":"The recommended recovery steps include restoring a backup from before Oct 15, deleting the rank-math-pro plugin folder, and running a security scan. If no clean backup exists, a manual cleanup is required in a specific order, including deleting suspicious files and accounts, and changing passwords and credentials.","

Expert Analysis":"Wordfence assigned the incident CVE-2026-111862 and rated it 9.8 out of 10. The malware uses base64_decode with XOR loops, proc_open, and PHP-FPM socket code. The cleanup process involves deleting specific files and accounts, and changing passwords and credentials. The cleanup ends with a security scan and verifying checksums for WordPress core and premium plugins."}