Rank Math Backdoor: When a Plugin Backdoor Starts Your 72-Hour Clock

A marketing plugin does not sound like a DFARS incident. Then it steals your credentials.

Rank Math confirmed a supply chain compromise in Rank Math SEO PRO 3.0.123. The tainted window ran from October 15, 2026 20:02 Coordinated Universal Time (UTC) to October 16, 2026 07:12 UTC. Packages downloaded or updated inside that window carried malware.

The flaw is tracked as CVE-2026-111862. CVE stands for Common Vulnerabilities and Exposures. Its Common Vulnerability Scoring System (CVSS) score is 9.8, Critical.

Why this can be a reportable incident

DFARS is the Defense Federal Acquisition Regulation Supplement. Its clause 252.204-7012 requires a cyber incident report to DoD within 72 hours of discovery.

The trigger is a cyber incident on a covered system. Credential theft counts. This malware exposes WordPress credentials, database credentials, API keys, SSH keys, and other secrets the web server can reach.

If your contractor website runs this plugin and it touched the tainted package, treat the reporting question seriously. Talk to counsel early.

Preserve first, then clean

The clause also requires keeping forensic images and logs for 90 days. Take the images before you start cleanup.

Then follow the vendor path. Restore from a backup made before October 15, 2026 20:02 UTC. Or delete the rank-math-pro directory, remove the malicious wp_options rows, and block outbound traffic to rank1cdn[.]com.

Audit administrator accounts, cron jobs, SSH keys, and writable locations. Rotate every secret the server could reach.

Confirm your incident reporting contact list is current.

Sources

• CVE-2026-111862 record, CVE Program.
• Rank Math SEO Pro 3.0.123 Malware, Wordfence. https://www.wordfence.com/blog/2026/10/rank-math-seo-pro-3-0-123-malware/
• Rank Math malware affected sites, Betanews. https://betanews.com/article/rank-math-malware-affected-sites/
• Rank Math vendor notice, rankmath.com. Authority for the compromise window and the indicator list.
• Original diagram by PolicyCortex.

More DFARS readiness guides live at dfarsreadiness.com.