Rank Math PRO EUVD-2026-104460

Compromise occurs ONLY if the site both (1) downloaded or updated the Rank Math SEO PRO 3.0.123 package specifically during the vendor-confirmed window of October 15, 2026 20:02 UTC to October 16, 2026 07:12 UTC, AND (2) activated the plugin so the bundled malware could execute. The vendor explicitly states that running version 3.0.123 by itself - obtained outside this window - is NOT sufficient to establish compromise, and packages outside the window are clean. The dominant limiting factors are therefore the extremely narrow 11-hour distribution window and the requirement that the plugin be activated; these constrain the real affected population to a small subset of 3.0.123 installs despite the maximal per-site impact. There is no special runtime configuration beyond normal plugin activation.

This is a vendor-confirmed supply-chain malware incident (CWE-506, Embedded Malicious Code) in Rank Math SEO PRO, reported by Wordfence and corroborated by the Rank Math security advisory. The input CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) reflects full server compromise but is a poor fit for the actual mechanism: there is no remotely exploitable network flaw - compromise is delivered by installing a trojaned package, so the 'network/no-privileges/no-interaction' framing overstates how an attacker reaches a victim. The real-world risk is sharply bifurcated and condition-dependent: for the narrow population that downloaded or updated 3.0.123 during the 11-hour window (Oct 15 2026 20:02 UTC - Oct 16 2026 07:12 UTC) AND activated the plugin, impact is maximal and should be treated as full site compromise per the vendor; for everyone else - including sites merely running 3.0.123 from outside the window - there is effectively no exposure, as the vendor explicitly states version alone does not establish compromise. No EPSS score, CISA KEV listing, or POC flag was provided in the input, so probabilistic exploitation signals are MISSING; however, because the malicious code is pre-planted and self-executing rather than requiring a separate exploit, those signals are less meaningful here than for a conventional vulnerability. Net: a genuine high-severity emergency for the affected window-population, but low aggregate risk across the general installed base.

A site administrator installs or auto-updates Rank Math SEO PRO to 3.0.123 during the compromised distribution window and activates the plugin, causing the embedded malware to execute with web-server privileges. The code plants hidden PHP backdoors and an unauthorized administrator account, beacons to rank1cdn[.]com, and harvests WordPress, database, and API credentials. No separate public exploit is needed because the malicious payload ships inside the package itself.