VYPR
Published Oct 19, 2026· 1 source

WordPress: Critical Rank Math Supply-Chain Attack and 24 Other Plugin Flaws Disclosed

Key findings • Critical supply-chain attack in Rank Math SEO PRO (CVE-2026-111862) led to malware infection. • 25 CVEs disclosed on Oct 19, 2026, affecting numerous WordPress plugins. • M…

Key findings

  • Critical supply-chain attack in Rank Math SEO PRO (CVE-2026-111862) led to malware infection.
  • 25 CVEs disclosed on Oct 19, 2026, affecting numerous WordPress plugins.
  • Multiple plugins suffer from broken access control and missing authorization vulnerabilities.
  • Stored and reflected Cross-Site Scripting (XSS) flaws found in several popular plugins.
  • Critical vulnerabilities include code injection, object injection, and unrestricted file uploads.
  • Prompt updates to the latest plugin versions are essential for mitigation.

On October 19, 2026, a significant batch of 25 vulnerabilities was disclosed across various WordPress plugins, with one critical supply-chain compromise in Rank Math SEO PRO demanding immediate attention. The disclosures, spanning a 10-hour window, highlight a range of security weaknesses, from critical remote code execution to medium-severity cross-site scripting and authorization bypass flaws.

The most alarming vulnerability, CVE-2026-111862, a critical supply-chain attack affecting Rank Math SEO PRO version 3.0.123, was disclosed on the same day. This incident involved malware embedded in plugin packages downloaded or updated between October 15 and October 16, 2026. Websites using these compromised versions are considered fully compromised, as the malware can establish a self-restoring backdoor. Rank Math has released version 3.0.124 as a clean replacement, but users must treat their sites as compromised and perform thorough cleanup beyond just updating the plugin. The Hacker News

Several other plugins were found to have broken access control or missing authorization vulnerabilities:

  • Sensei LMS (versions before 4.26.4) suffers from broken access control in its legacy save_new_message handler and add_new_module_term AJAX handler, allowing authenticated attackers to manipulate messages or assign terms to arbitrary courses. (CVE-2026-112329, CVE-2026-112328)
  • Surfer SEO (up to 1.8.0.744) has a missing authorization vulnerability. (CVE-2026-112222)
  • WP Mailster (up to 1.9.1.0) is affected by a PHP Local File Inclusion vulnerability due to improper control of filenames. (CVE-2026-111829)
  • Event Tickets (up to 5.30.1) has an authorization bypass vulnerability. (CVE-2026-110902)
  • YITH WooCommerce Product Bundles (up to 2.29.0) and FluentForm (up to 6.2.15) also exhibit missing authorization flaws. (CVE-2026-111845, CVE-2026-111831)
  • LearnPress (up to 4.4.10), FluentCommunity (up to 2.11.0), and VideoWhisper Broadcast Live Video (up to 7.3.7) are similarly affected by missing authorization issues. (CVE-2026-110363, CVE-2026-111836, CVE-2026-111839)
  • Classified Listing (up to 6.1.5) has a vulnerability related to improper input validation. (CVE-2026-111828)
  • App Builder (before 5.7.1) allows unauthenticated users to write attacker-supplied data to options and redirect visitors. (CVE-23-94294)
  • Snap Finance (before 3.12.0) allows unauthenticated attackers to alter WooCommerce order statuses. (CVE-2026-94272)
  • TrueBooker (before 1.3.0) has authorization flaws enabling unauthenticated users to create and modify booking services. (CVE-2026-94231)

Cross-site scripting (XSS) vulnerabilities were identified in several plugins:

Other notable vulnerabilities include:

  • A critical deserialization of untrusted data vulnerability in Quiz And Survey Master (up to 11.2.7) allows for object injection. (CVE-2026-111408)
  • A critical unrestricted file upload vulnerability in MapSVG (up to 8.16.1) allows for web shell uploads. (CVE-2026-111406) This plugin also has a path traversal vulnerability. (CVE-2026-111398)
  • Essential Addons for Elementor (up to 6.8.5) has an incorrect privilege assignment vulnerability. (CVE-2026-110898)
  • HivePress (up to 1.7.32) is affected by a critical code injection vulnerability. (CVE-2026-110887)

The majority of these vulnerabilities were patched by their respective vendors, with affected versions typically ranging from the initial release up to a specific point before the patch. Users are strongly advised to update all affected plugins to their latest versions to mitigate these risks. The sheer volume and variety of vulnerabilities disclosed on this single day underscore the importance of continuous security monitoring and prompt patching for WordPress sites.

The batch of 25 CVEs disclosed on October 19, 2026, presents a stark reminder of the diverse threats facing WordPress websites. While the critical supply-chain attack on Rank Math SEO PRO demands immediate action, the numerous other vulnerabilities, including authorization bypasses, XSS, and code injection flaws, highlight the need for a comprehensive security strategy. Users should prioritize updating plugins, especially those identified in this disclosure, and remain vigilant for further security advisories. The interconnected nature of the WordPress ecosystem means that a vulnerability in one plugin can have widespread implications, making prompt patching essential for maintaining site integrity.

Synthesized by Vypr AI