CVE-2026-111862

{
  "etk_id": "ETK-2026-2069",
  "cve_id": "CVE-2026-111862",
  "display_id": "CVE-2026-111862",
  "ghsa_id": "GHSA-6qfj-hq55-w68p",
  "euvd_id": "EUVD-2026-104460",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Supply-chain malware in Rank Math SEO PRO",
  "summary": "Some Rank Math SEO PRO 3.0.123 packages obtained between October 15 and 16, 2026 contained malicious code. When one of those packages was activated, an attacker could retain access to the WordPress site and obtain credentials or other secrets accessible to the server; installations outside that download window are not identified as affected.",
  "mitigation": "Replace the plugin with Rank Math SEO PRO 3.0.124 and investigate any site that activated a package obtained during the affected window as compromised. Rotate WordPress, database, API, and other server-accessible credentials, and remove unauthorized persistence identified during the investigation.",
  "vendor": "RankMath",
  "product": "Rank Math SEO PRO",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "3.0.123"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Rank Math SEO PRO",
      "purl": null
    }
  ],
  "cwes": [
    506
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0072,
  "epss_percentile": 0.5294,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.010014966666666666,
  "t0_at": "2026-10-19T16:35:59.949000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-20T19:01:11.587503+00:00",
      "days": 1.1008291493402778,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T16:35:59.949000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-19T16:35:59.949000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T16:35:59.949000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111862"
    }
  }
}