Rank Math PRO 3.0.123 Backdoor (CVE-2026-111862): What to Check Now

Some copies of Rank Math PRO 3.0.123, the paid WordPress SEO plugin, carried malware when fetched from rankmath.com between 20:02 UTC on 15 October and 07:12 UTC on 16 October 2026. The free WordPress.org plugin was not affected. If you activated a window copy, treat the site as compromised, clean it in order, rotate every secret, then install 3.0.124.

The incident is tracked as CVE-2026-111862, rated CVSS 3.1 9.8 and classed as CWE-506, embedded malicious code. It is not a coding bug. Nobody found a flaw in how the plugin handles input. For about eleven hours, the vendor's own download and update channel handed out a build that someone had altered, and the build looked like an ordinary point release with an ordinary version number.

That last detail is what makes this one awkward. Rank Math's changelog dates the legitimate 3.0.123 to 7 October, more than a week before the bad window opened. So "we run 3.0.123" does not tell you whether you are affected, and "we updated to 3.0.124" does not tell you whether you are clean. This post walks through what is known, what is not, the exact indicators the vendor published, and a cleanup order that does not let the backdoor rebuild itself while you work.

We covered a related WordPress story from the same week, stolen UpdraftCentral keys used to push backdoor plugins. The two incidents share an ecosystem and a week, nothing more. No source links them to the same actor, and we do not either.

What happened

Rank Math published its notice on 16 October at 20:32 UTC, according to the page's own metadata, and last modified it on 22 October at 10:01 UTC. The notice says a "limited number of users" who downloaded PRO 3.0.123 during the window received files containing malware that "could compromise your website if the plugin was activated". Rank Math removed the files and released 3.0.124 as the clean build.

As part of its response, Rank Math says it "refreshed some of our systems". One side effect: free accounts registered on rankmath.com between 13 and 16 October were removed, and those users have to register again to reconnect features like Search Console data, the rank tracker and the AI tools. Their plugin and SEO settings keep working.

Rank Math has not said how the malicious files got into its distribution system, how many customers received them, whether automatic updates delivered them, or what the hashes of the clean and tainted packages are. BleepingComputer asked about the number of affected sites and the initial vector and had no answer at publication. The Hacker News reported the same gaps.

Timeline

All times UTC, 2026.

Two things in that table deserve a second look. The attacker domain was registered about 24 and a half hours before the window opened, which suggests preparation rather than a smash and grab. And the CVE record's own timeline puts discovery on 15 October, the same day the window opened, while the clean build and notice only arrived on 16 October.

Who is affected

The short answer: sites running Rank Math PRO whose copy of 3.0.123 was fetched during the window and then activated. Everyone else is either unaffected or needs only a precautionary step.

The free plugin's WordPress.org listing shows more than 4 million active installations. That number covers the free plugin only. Rank Math has not published how many PRO installs exist, and no source we read gives a count of affected sites. Any figure you see quoted for affected sites should be treated as an estimate unless it comes from Rank Math.

Agencies and hosts deserve a special mention. A single agency account often pushes PRO to dozens of client sites, and managed hosts sometimes stage premium plugin updates centrally. If one person on your team downloaded the zip during the window and uploaded it to several sites, every one of those sites is in the "activated" row.

How it works, in plain language

We are not going to describe the payload's internals beyond what defenders need to recognise it. Here is the shape, drawn from Rank Math's notice and the reporting that followed.

1. Delivery through a trusted channel. Premium WordPress plugins usually do not update from WordPress.org. The plugin carries its own updater that asks the vendor's server for new versions, using a license key. When that server hands out a tampered zip, WordPress installs it like any other update. Nothing in core checks a vendor's zip against an independent signature.
2. Activation triggers the payload. Rank Math says the malware runs when the plugin is activated. A copy that was downloaded and never installed is inert.
3. Persistence that rebuilds itself. Rank Math warns that the malware "can recreate its hidden backdoor whenever someone visits the website". In practice that means a stored value in the database plus code that checks on page loads whether its files still exist and puts them back if not. Delete the files first and the next visitor's request may restore them.
4. Command and control. The malware talks to rank1cdn[.]com, a lookalike name that reads like a content delivery domain for Rank Math. It is not a Rank Math domain.
5. Footholds outside the plugin. The notice lists hidden PHP files in must-use plugins and other plugins' folders, a fake core file, .htaccess rules that make .cache files run as PHP, administrator accounts, WordPress scheduled events, entries in the web server user's crontab and SSH keys. Some of those survive even a full plugin removal, and some survive a WordPress reinstall.
6. Secrets exposure. Rank Math tells owners to assume that every secret the web server could read is exposed: database credentials, salts, payment and SMTP keys, API tokens, hosting and SSH access, and environment variables.

This is why "update to the fixed version" is the wrong mental model. For a normal vulnerability, the fixed version closes the hole. Here the hole was the update itself, and the damage happens on activation. The new version is the last step of recovery, not the first.

Technical details

Everything in this section comes from a fetched primary or near-primary source, attributed in the table. Domains are defanged with [.].

Identifiers and scoring

One WordPress vulnerability database notes that because the attack hit the vendor's own infrastructure, "a rule is not possible for mitigation". In other words, a web application firewall rule cannot block a payload that arrives as the plugin's own code.

Distribution window

Rank Math's restore advice uses the opening time: a backup made before 15 October at 20:02 UTC is the recovery point it recommends.

Indicators of compromise from Rank Math's notice

Domain registration

Verisign's RDAP service shows rank1cdn[.]com registered on 14 October 2026 at 19:31:14 UTC, last changed at 19:44:50 UTC, expiring 14 October 2027, with "client delete prohibited" and "client transfer prohibited" status, and nameservers at a large CDN provider. Registration a day before the window does not prove who registered it. It does show the infrastructure existed before the poisoned builds went out.

A related sample, unconfirmed as the delivery vector

BleepingComputer found a PHP file in a public malware repository named cache-preloader-fff033 (1).php, SHA-256:

f99a42f622e9a638f1b27dc051a48619a5a2d7f3432a4480fecf1413253629c9

According to BleepingComputer, the file shares Rank Math's indicators (the xmmqhn key, the _np5pvf754c option, the #ms6v46 cron marker, and wpsupport_ and @wp-mail.net admin creation) and appears to be a first stage that creates the class-wp-cache-util.php backdoor. BleepingComputer reports it can also run commands, change the WordPress database and steal cloud credentials for AWS, Google Cloud and Azure, a CDN provider's tokens and SSH keys. BleepingComputer also says plainly that it "could not confirm" the file was distributed through the compromised plugin. Use the hash as a hunting lead, not as proof that the plugin carried that exact file.

What has not been published

• Hashes of the tainted 3.0.123 zip or of the clean 3.0.124 zip.
• The number of downloads or updates served during the window.
• Whether WordPress auto-updates pulled the tainted build, or only manual downloads.
• The initial access vector into Rank Math's distribution systems.
• Any attribution.
• A full code analysis from Rank Math or from the CVE assigner.

The Hacker News checked WordPress.org's plugin checksum service on 19 October and found no checksum file for the PRO plugin under either of its names, while the service does publish one for the free plugin. We repeated the check on 24 October: the free plugin's checksum file for 1.0.280 returns HTTP 200, and lookups for rank-math-pro and seo-by-rank-math-pro at 3.0.124 return 404. That matters for cleanup, because wp plugin verify-checksums cannot vouch for a premium plugin it has no reference for.

What changed since first reports

• 16 October: Rank Math's notice framed the issue and gave the window, the clean version and the first cleanup steps.
• 17 October: A security vendor's advisory and a vulnerability database entry gave it a severity and a patched version. Some outlets began calling it "exploited in the wild".
• 19 October: The CVE record went public with the 9.8 score. BleepingComputer added the related sample and its hash. The Hacker News pointed out that the version number alone does not prove compromise and that no checksum reference exists for PRO.
• 20 October: CISA's ADP assessment set Exploitation to "none". That is CISA's SSVC label for the absence of public evidence of exploitation activity beyond the malicious release itself.
• 22 October: Rank Math updated its notice. The current text includes the detailed indicators, the cleanup order and the account recreation steps.

The "exploited in the wild" question

Sources disagree on wording here, and it is worth being precise. SecurityOnline called the issue "actively exploited in the wild". CISA's SSVC entry says "none". Both can be read as true, depending on the definition. Every activated copy from the window ran attacker code, so in that sense exploitation happened by design. What nobody has published is telemetry of follow-on attacker activity: logins through the planted accounts, data theft from a named site, or commands sent from rank1cdn[.]com. Treat "exploited" as "the malware shipped and ran", not as "there is evidence of hands on keyboard at scale".

What to do now

Work through these in order. The order is the point. Rank Math's notice says that removing files before disabling what recreates them "may not resolve the issue".

Step 0: Decide whether you are in scope

On each site, find the PRO version and, if possible, when it arrived.

# Version of the PRO plugin (slug may be rank-math-pro or seo-by-rank-math-pro)
wp plugin list --fields=name,status,version,update | grep -i rank

# When were the plugin files written? Extraction time is a rough proxy for install time.
stat -c '%y %n' wp-content/plugins/rank-math-pro/rank-math-pro.php 2>/dev/null \
  || stat -f '%Sm %N' wp-content/plugins/rank-math-pro/rank-math-pro.php

# Files written inside the window (server clock, adjust for your timezone)
find wp-content/plugins/rank-math-pro -type f \
  -newermt '2026-10-15 20:02 UTC' ! -newermt '2026-10-16 07:12 UTC' | head

File times are a heuristic. A copy downloaded during the window and uploaded days later will show the later date. Check your web server logs for plugin update requests during the window, and ask whoever handles plugin uploads whether they downloaded a zip from rankmath.com in that period.

# Look for plugin upgrade actions in the access log during the window
grep -E 'update\.php\?action=(upgrade-plugin|update-selected)|plugins\.php\?action=activate' \
  /var/log/nginx/access.log* | grep -E '15/Oct/2026|16/Oct/2026'

If you can prove the copy arrived outside the window, move to 3.0.124 and run the indicator checks in Step 2 as a precaution. If you cannot prove it, treat it as in scope.

Step 1: Choose restore or manual cleanup

Rank Math's preferred path is restoring both files and database from a backup made before 15 October at 20:02 UTC. A restore is faster and more complete than a hunt, but it does not remove anything outside the backup's scope (system crontabs, SSH keys, other sites on the same account), and it does not un-leak secrets. You still do Steps 2c and 3.

Step 2a: Stop the rebuild loop

Do all three of these before touching anything else.

# 1. Delete the whole plugin folder. Deactivating is not enough.
rm -rf wp-content/plugins/rank-math-pro

# 2. Remove the three option rows. Get the real table prefix first.
PREFIX=$(wp db prefix)
wp db query "SELECT option_name FROM ${PREFIX}options WHERE option_name IN ('_uf6qdn2hmm','t8krdk990phb','_np5pvf754c');"
wp option delete _uf6qdn2hmm
wp option delete t8krdk990phb
wp option delete _np5pvf754c

# 3. Block the domain from the host if you have no egress firewall
echo '0.0.0.0 rank1cdn.com' | sudo tee -a /etc/hosts

On a multisite network, options live per site. Repeat the option check for each site:

for url in $(wp site list --field=url); do
  echo "== $url"
  wp --url="$url" option get _uf6qdn2hmm 2>/dev/null && echo "FOUND on $url"
  wp --url="$url" option get t8krdk990phb 2>/dev/null && echo "FOUND on $url"
  wp --url="$url" option get _np5pvf754c 2>/dev/null && echo "FOUND on $url"
done

If you have an egress firewall, a DNS resolver you control, or a host level allow list, block rank1cdn.com there as well. A hosts file entry only covers that one machine.

Step 2b: Hunt the footholds

# Fake core file
ls -la wp-includes/class-wp-cache-util.php

# Core integrity (core has published checksums; plugins from WordPress.org do too)
wp core verify-checksums
wp plugin verify-checksums --all

# PHP in places it should not be
find wp-content/uploads -type f -name '*.php'
find wp-content/mu-plugins -type f -name '*.php' -newermt '2026-10-15'

# .cache files that contain PHP
find . -type f -name '*.cache' -exec grep -l '<?php' {} +

# .htaccess rules that make .cache run as PHP
grep -RniE 'cache' --include=.htaccess . | grep -iE 'php|handler|SetHandler|AddType'

# Rank Math's code trait strings (leads, not proof)
grep -RIl --include='*.php' -e 'xmmqhn' -e 'rank1cdn' wp-content wp-includes .

Then accounts and scheduled tasks:

wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
wp user list --role=administrator --fields=user_login,user_email | grep -iE 'wpsupport_|@wp-mail\.net'

wp cron event list --fields=hook,next_run_gmt,recurrence

# System crontab of the web server user (www-data, apache, nginx, or your PHP-FPM pool user)
sudo crontab -l -u www-data | grep -n 'ms6v46'

Remove confirmed malicious accounts with wp user delete and reassign their content. Before you delete, export the list with registration times; it helps date the intrusion.

Step 2c: Look outside WordPress

Rank Math's notice lists host level checks. On a VPS or dedicated server:

# SSH keys for the web user and for root
sudo find / -name authorized_keys -path '*/.ssh/*' -exec ls -la {} \; 2>/dev/null

# Crontabs for every user
for u in $(cut -d: -f1 /etc/passwd); do sudo crontab -l -u "$u" 2>/dev/null | sed "s/^/$u: /"; done

# Processes owned by the web user
ps -u www-data -o pid,lstart,cmd

# Writable paths outside the site that the web user owns
sudo find / -xdev -user www-data -type f -newermt '2026-10-15' 2>/dev/null | grep -v '/var/www/'

On shared hosting you probably cannot run these. Ask the host to run them for your account.

Step 3: Rotate everything the site could read

Rank Math calls this step essential even after a restore. A practical order:

1. Database user password in wp-config.php, then update the file.
2. WordPress keys and salts (wp config shuffle-salts), which logs everyone out.
3. All administrator and editor passwords, and reset two factor enrolments for admins.
4. Payment gateway keys, SMTP credentials and any API keys stored in plugin settings or the options table.
5. Cloud credentials the host could read: instance roles, access keys in environment files, CDN and DNS tokens, object storage keys used by backup or media plugins.
6. Hosting panel, FTP, SFTP and SSH credentials, and any deploy keys on the server.

If BleepingComputer's related sample is part of this campaign, cloud credentials and SSH keys are the high value targets. Rotate those even if you found no file indicators.

Step 4: Install 3.0.124 and watch

Log in at rankmath.com directly, download 3.0.124 from your account, and install it last. Rank Math says it never sends download or login links by email, so treat any such email as phishing. Then for the next week:

# Re-run the two fastest checks daily
ls -la wp-includes/class-wp-cache-util.php 2>/dev/null && echo 'REAPPEARED'
wp option get _np5pvf754c 2>/dev/null && echo 'OPTION BACK'

Watch outbound DNS and connection logs for rank1cdn.com. A file that comes back means a foothold you missed. Rank Math's advice in that case is to go back to Step 2.

Fleet version: one loop across many sites

For agencies and hosts running WP-CLI across many installs:

for path in /var/www/*/public; do
  v=$(wp --path="$path" plugin get rank-math-pro --field=version 2>/dev/null)
  [ -z "$v" ] && continue
  hit=""
  [ -f "$path/wp-includes/class-wp-cache-util.php" ] && hit="$hit core-file"
  for o in _uf6qdn2hmm t8krdk990phb _np5pvf754c; do
    wp --path="$path" option get "$o" >/dev/null 2>&1 && hit="$hit option:$o"
  done
  wp --path="$path" user list --role=administrator --field=user_login 2>/dev/null \
    | grep -q '^wpsupport_' && hit="$hit admin"
  echo "$path pro=$v ${hit:-no-indicators}"
done

A "no indicators" result on a site that ran a window copy is not a clean bill of health. It means the quick checks did not fire. Those sites still need the rotation in Step 3.

Common mistakes

• Updating and calling it done. Moving to 3.0.124 replaces the plugin folder. Admin accounts, .cache files, the fake core file, crontab entries and stolen secrets all stay.
• Deactivating instead of deleting. Rank Math says deactivation is not enough. Delete the folder.
• Deleting files before the database rows. The stored option drives the rebuild. Remove it, and block the domain, first.
• Trusting verify-checksums for PRO. WordPress.org has no reference checksums for this premium plugin, so the command cannot vouch for it. Compare against a fresh 3.0.124 from your account instead.
• Restoring the wrong backup. A backup taken on 16 October may already contain the payload. The cutoff is 15 October, 20:02 UTC.
• Forgetting multisite. Options are per site. Check every site in the network.
• Skipping host level checks on a VPS. Crontab entries and SSH keys outside the web root survive a WordPress reinstall.
• Rotating passwords but not salts. Old sessions keep working until the keys and salts change.
• Following a "download the fix" email. Rank Math will not send one. Go to rankmath.com yourself.
• Assuming the version number proves anything. 3.0.123 existed cleanly from 7 October. Timing and indicators decide, not the number.

What would have helped

None of this is a criticism of Rank Math or its customers. Vendor update channels are a trust relationship every WordPress site relies on, and the practices below are ones any team can adopt for any premium plugin or theme.

Practices any team can use

Stage premium plugin updates. WordPress.org plugins benefit from a public repository and community review. Premium plugins update from the vendor's own server under a license key. Turn off automatic updates for premium plugins on production, let them land on a staging or canary site first, and promote after 24 to 48 hours. An eleven hour bad window, like this one, would have closed before a two day delay expired. That is a property of the timing here, not a guarantee for the next incident.

Deploy plugins from your own repository. Many teams build WordPress from Git or Composer and set DISALLOW_FILE_MODS to true in production so nothing installs from the admin screen. The premium zip goes into a private repository after review, its SHA-256 is recorded, and the deploy pipeline refuses a zip whose hash does not match. If a vendor later publishes hashes, compare them. If it does not, at least your own record tells you exactly which zip went to which site and when, which turns Step 0 above from guesswork into a lookup.

# Record what you deploy
sha256sum rank-math-pro-3.0.124.zip >> plugin-hashes.txt

# Diff a deployed tree against the reviewed copy
diff -rq /srv/reviewed/rank-math-pro wp-content/plugins/rank-math-pro

File integrity monitoring. Alert on new PHP files in uploads/, mu-plugins/ and wp-includes/, on any change to .htaccess, and on new .cache files that contain PHP. These directories rarely change on a healthy production site.

Egress allow lists for PHP hosts. A typical WordPress server needs to reach WordPress.org, a handful of vendor update and license servers, payment and email providers, and its backup target. It does not need arbitrary outbound access. An allow list would not stop a payload from running, but it would block a newly registered domain like rank1cdn[.]com from receiving data or sending instructions.

Least privilege for the web user. The PHP process should not own its own code in production, should not have a login shell, and should not be able to edit its own crontab. Keep cloud credentials out of files the web user can read; use short lived, narrowly scoped tokens.

Backups you can restore by timestamp. Rank Math's preferred recovery depends on a backup before a precise UTC time. Keep daily file and database backups for at least 30 days, offsite, and test a restore.

An inventory of what runs where. Agencies should be able to answer "which client sites run plugin X at version Y, and who installed it" in minutes. A spreadsheet works for ten sites. Beyond that you want a generated inventory.

Where Safeguard fits

For an incident like this, the useful part is the inventory and the follow through.

• Inventory. If your WordPress sites are built from repositories or container images, Safeguard can scan them (safeguard scan --dir ., --image <name>, or --sbom <file>, results as JSON under ./output) and the platform shows which projects contain a given component and version. For teams that vendor premium plugins into Git, that answers "where is rank-math-pro 3.0.123" across many repositories. Premium plugins installed by hand through the admin screen are invisible to any repository scan; that is an argument for the deploy-from-repo practice above.
• The PHP underneath. The same scans match the PHP runtime, base images and Composer dependencies against vulnerability databases, with reachability analysis, which matters in a month when PHP itself needed emergency patches. See our PHP2Shell explainer.
• Policies and gates. Policies and gates evaluated in the platform can flag a specific component version, so an agency's pipeline can refuse to ship 3.0.123 again. The gate works on what the scan sees; it does not judge whether a zip is malicious.
• The cleanup itself. The Safeguard CLI's assistant can write and run the WP-CLI checks in this post against your sites, editing and running commands only with your approval. /permissions sets the mode (Ask, Accept edits, Plan, Auto by default, or Strict); for production hosts, Ask or Strict is the sensible choice. The desktop and phone apps can send that work to a computer running the CLI and let you approve each command.

Some of the work sits outside any tooling: a hosted WordPress site with no repository, a premium vendor's distribution server, and rotating your payment keys all need people and process.

Zero-Day Discovery and Gold

Zero-Day Discovery looks for previously unknown flaws before a CVE exists, in an agentic mode and a deterministic scanner mode, and issues findings as SGZ advisories before they reach public CVE databases. It covers seven package ecosystems. A premium WordPress plugin delivered from a vendor's own server is outside those ecosystems.

Gold Open Source at gold.safeguard.sh is free CVE intelligence with CVSS, EPSS, KEV status, affected and fixed versions and a recommended safe version. For this incident, the vendor's notice and the CVE record are the authorities on the safe version (3.0.124). Gold Registry is built for hardened, signed open source components and container images, so for this incident it is relevant only to the open source PHP and container layers beneath your sites, not to the premium plugin.

Open questions

• How did the files get in? Rank Math has not said whether the build system, the download server, a CDN, an account or a signing step was compromised.
• How many sites? No count of downloads, updates or activations in the window has been published.
• Did auto-update deliver it? The notice says "downloaded or updated". It does not say whether the in-dashboard updater served the tainted build.
• What are the hashes? Neither the bad 3.0.123 nor the clean 3.0.124 zip has a published hash.
• Is the related sample the same payload? BleepingComputer could not confirm it.
• What does the "system refresh" mean? The deletion of free accounts registered from 13 to 16 October suggests the vendor rebuilt account systems, but Rank Math has not explained why those dates.
• Is it over? As of 24 October, rank1cdn[.]com remains registered.

FAQ

Is the free Rank Math SEO plugin affected?

No. Rank Math says the free plugin on WordPress.org is not affected and needs no action. The only side effect for free users is that rankmath.com accounts registered from 13 to 16 October were removed and need to be recreated.

I am on 3.0.124 now. Am I safe?

Only if no tainted 3.0.123 was ever activated on that site. If one was, updating replaced the plugin files but left any admin accounts, files, cron entries and stolen secrets in place. Run the checks in Steps 2a to 2c and rotate secrets.

How do I know whether my 3.0.123 came from the window?

There is no published hash to compare. Use install timestamps, web server logs of update actions, and your team's memory of downloads, then run the indicator checks. If you cannot rule it out, treat the site as in scope.

Can a web application firewall protect me?

Not from the payload itself. The code arrives as part of a plugin you installed, so a firewall rule cannot block it. Egress controls on the server can block traffic to rank1cdn[.]com, which limits what the malware can do after it runs.

What does CVSS 9.8 mean for a backdoor?

The score reflects network reachable, no privileges, no user interaction, total impact. For embedded malicious code the score says little about how likely you are to be hit. Your exposure depends entirely on whether you fetched and activated a window copy.

Was it exploited in the wild?

Sources differ. SecurityOnline says yes; CISA's SSVC assessment says "none". The malware ran on any site that activated it. No public telemetry shows follow-on attacker activity.

Is this linked to the UpdraftCentral incident?

They happened in the same week in the same ecosystem. No source we read links them, and we do not suggest a link.

Do I need to rebuild the server?

If you found host level footholds (unknown SSH keys, crontab entries for other users, unexplained processes), rebuilding from a known good image is the safest option. If the site is on shared hosting, ask the host to check your account.

Should I stop using premium plugins?

No. Stage their updates, deploy from a reviewed copy you control, monitor file changes, and restrict outbound traffic. Those steps reduce the impact of any vendor channel compromise.

Who assigned the CVE?

A WordPress security vendor acting as CVE Numbering Authority reserved it on 17 October and published it on 19 October.

Fix it without waiting for upstream

This incident is unusual because the clean build came from the vendor the same day, and the hard work is cleanup, not patching. The block below is how Safeguard helps with the open source dependencies and container images under your WordPress sites. The premium plugin itself is covered by the honest limit at the end.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would have helped

None of these demos shows this incident. Each shows a real flow on another example, and the notes explain how the same flow applies to a Rank Math PRO cleanup.

The desktop app demo sends work to your computer: you pick a folder, then Approve or Deny each command and file edit, and it ends with an upgrade done and tests passing. For this incident, you would point it at the WordPress root on a staging copy and ask it to run the Step 2 indicator checks, approving each wp and find command before it runs.

Click through it at your own pace, or open it full screen.

The CLI demo fixes a lodash CVE: the assistant reads the finding, asks before each command, edits package.json, runs the install and tests, and pushes nothing. Here, the same session in an agency's site repository could swap the vendored plugin folder for a reviewed 3.0.124 copy, record its SHA-256 and run your smoke tests, with you approving each step.

Click through it at your own pace, or open it full screen.

The mobile demo is a real Android session: you send work to a computer running the CLI and approve a command on the phone with Allow once, Allow for turn or Deny. During an incident that matters when the person who can approve a crontab change or a folder deletion on a production host is away from a desk.

Click through it at your own pace, or open it full screen.

To try it on your own sites, download Safeguard and follow the CLI docs.

For more on handling a compromised dependency, see our incident response playbook for a compromised dependency, how to use an SBOM to find affected products fast, and our PHP security explainer.

Quick check

Sources

• Rank Math: PRO 3.0.123 Security Incident, How to Secure Your Website
• Rank Math changelog
• CVE-2026-111862 record and history (OpenCVE view of the CVE, NVD and CISA ADP data)
• WordPress vulnerability database entry for Rank Math SEO PRO 3.0.123
• Verisign RDAP record for rank1cdn.com
• WordPress.org: Rank Math SEO (free plugin)
• WordPress.org plugin information API for seo-by-rank-math
• WP-CLI: wp plugin verify-checksums
• WP-CLI: wp core verify-checksums
• MITRE CWE-506: Embedded Malicious Code
• BleepingComputer: WordPress SEO plugin Rank Math compromised to backdoor websites
• The Hacker News: Popular WordPress SEO plugin Rank Math PRO hijacked to deliver self-restoring backdoor
• SecurityWeek: Rank Math PRO WordPress plugin compromised in supply chain attack
• SecurityOnline: Rank Math SEO PRO supply-chain compromise

Last reviewed: 24 October 2026. This is a developing story; check the linked advisories for the latest status.