October was a hard month for WordPress sites. The incident that drew the most attention involves the paid PRO version of the popular Rank Math SEO plugin. On 15–16 October, for about 11 hours, version 3.0.123 delivered from the official site and the update channel contained malware (CVE-2026-111862). This time it was the owners who updated on time who got hit.
In the same month a critical flaw in the Bricksforge plugin (CVE-2026-85097, CVSS 10) was exploited in real attacks: anyone could upload a PHP file to the server through a form, without logging in. Sucuri also described a backdoor that hides in more than eight places: in files, in the database and even in server memory.
What these infections have in common is that they restore themselves. You delete a file and it comes back on the next page load or through a cron job. Hidden admin accounts, altered .htaccess rules and extra SSH keys are common too. That is why updating the plugin or deleting one file is not enough.
If your site is infected
- The most reliable option is to restore a backup taken before the infection.
- Clean everything in one pass: files, database, cron jobs and user accounts.
- Then change every password and key: admin, database, hosting, SSH and API.
- Update Rank Math PRO to 3.0.124 or later and Bricksforge to the latest version.
Support from Coresoft
The Coresoft team audits the security of WordPress sites, removes malware with every trace of it, brings the site back to a safe state and sets up monitoring against further attacks. To use this service, contact us.
Sources: The Hacker News, The Hacker News, Sucuri / The Hacker News.
