Your WordPress Site Is Compromised and Your Router Is Next: What UK Small Businesses Must Do This Week
Two stories broke in the last 48 hours. One targets your website. One targets your network. Neither sent a warning. Both are being actively exploited.
This is not theoretical risk analysis. This is the situation on the ground today, the 20th of October 2026. Here is what the data shows, stripped of vendor dramatics, and here is what you actually need to do.
Story One: The Rank Math PRO Supply Chain Attack
Between 20:02 UTC on the 15th of October 2026 and 07:12 UTC on the 16th of October 2026, anyone who downloaded or updated Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, received malware instead of a legitimate update. That is an eleven-hour window during which the plugin’s own distribution infrastructure was used as a delivery mechanism for a backdoor.
The vulnerability is tracked as CVE-2026-111862, with a CVSS score of 9.8. Rank Math has confirmed that affected plugin files contained malware. Their own guidance is unambiguous: if you activated an affected package, treat the website as compromised.
The malware does three things that make it particularly difficult to clear. First, it establishes persistent access. Second, it communicates with an external command-and-control domain, rank1cdn[.]com. Third, and this is the detail that matters most practically, it recreates hidden backdoors on page visits. That means simply deleting the malicious file is not enough. Every time someone visits your site, the backdoor rebuilds itself. You cannot clean your way out of this with a file deletion. You need to treat the site as fully compromised and work from there.
The malware also exposes WordPress credentials and database credentials. That is not a secondary risk. If your WordPress admin password is the same password you use elsewhere, or if your database credentials are reused in any other system, the blast radius extends well beyond your website.
Who is affected?
Any WordPress site that downloaded or updated Rank Math PRO from rankmath.com during that eleven-hour window. If you updated automatically, you may not know it happened. Check your plugin update logs. If you cannot confirm the exact update timestamp, assume the worst and investigate accordingly.
Story Two: H3C Magic NX15 Router Vulnerabilities
Two separate critical vulnerabilities were published for the H3C Magic NX15 router on the 19th of October 2026, both carrying a CVSS score of 9.9.
CVE-2026-112370 is an OS command injection vulnerability in the sub_416874 function of the /usr/bin/usrlist file. CVE-2026-112371 is a code injection vulnerability in the write function of the /api/esps RPC interface, exploitable via manipulation of the path argument. Both are remotely exploitable. Both have public exploits already in circulation.
The H3C Magic NX15 is the type of device that sits in a small office, gets set up during an IT refresh, and is then ignored for years. Firmware updates are not automatic. Most small business owners have no idea what firmware version their router is running, and no process for checking. That is precisely why these devices are attractive targets.
Remote code execution on a router is not a minor inconvenience. A compromised router sits between your business and the internet. It can intercept traffic, redirect connections, facilitate man-in-the-middle attacks against your own staff, and provide persistent access to your network that survives reboots and device replacements downstream. It is a position of significant leverage for an attacker.
The Pattern Worth Naming
These two incidents are not unrelated. They share a common exploit logic that is worth making explicit.
Attackers are targeting the infrastructure that small businesses trust and stop thinking about. The plugin you installed eighteen months ago and set to auto-update. The router that came with the office and has not been touched since. The software that runs quietly in the background, doing its job, never demanding attention.
That inattention is the attack surface. Not a failure of technology. A failure of ongoing oversight.
The Rank Math supply chain attack is a direct echo of patterns seen in previous WordPress plugin compromises. The attackers did not need to find a vulnerability in your site’s code. They compromised the distribution mechanism itself. The plugin vendor’s infrastructure became the weapon. That is a supply chain attack, and it is effective precisely because users trust the update process.
The router vulnerabilities follow a different route to the same destination: exploitation of devices that are present in vast numbers of small business premises, running outdated firmware, with no monitoring and no patching cadence.
How to Use This as a Competitive Differentiator
If your business runs a website for clients, manages IT for other businesses, or handles customer data through a WordPress installation, your response to this incident is a tangible demonstration of security competence.
Clients and prospective clients do not generally ask whether your WordPress plugins are up to date. They should. The fact that you are already checking, already have a process, and can demonstrate that your site was not affected (or that you identified and remediated an issue promptly) is a concrete signal of operational maturity.
For businesses that manage WordPress sites on behalf of clients, this is a moment to show that your oversight adds real value. An MSP or web agency that proactively contacted every client using Rank Math PRO this week, checked their update logs, and took appropriate action has just demonstrated something no marketing brochure can replicate.
On the router side: knowing what firmware version your network hardware is running, and having a process for applying updates, is increasingly relevant in procurement and due diligence conversations. Supply chain risk is now a standard question in tender documentation. Having answers is an advantage.
Making the Case to Your Board or Decision-Maker
Three points that will land:
Website compromise has direct commercial consequences. A backdoored WordPress site leaks credentials, serves malware to visitors, and risks ICO notification obligations under UK GDPR if personal data is exposed. The Rank Math incident is not a hypothetical. It happened last week. The cost of investigation and remediation is real. The cost of a notifiable breach is larger.
Network infrastructure is not a set-and-forget investment. A router running exploitable firmware is not a functioning piece of security infrastructure. It is a liability. The H3C vulnerabilities carry a CVSS score of 9.9 out of 10, with public exploits. The argument for replacing or patching network hardware is now quantified.
Supply chain risk is not an enterprise problem. The Rank Math attack targeted every WordPress site running that plugin, regardless of the site owner’s size. Small businesses are not excluded from supply chain compromise. They are often the preferred target, precisely because their oversight is lighter. Demonstrating that your business takes this seriously is a differentiator in any sector where clients care about data handling.
What to Do This Week
If you run a WordPress site:
-
Check whether Rank Math PRO is installed. If it is, check your plugin update history. Look for any update that occurred between 20:02 UTC on the 15th of October and 07:12 UTC on the 16th of October 2026.
-
If you updated during that window, follow Rank Math’s guidance and treat the site as compromised. Do not simply delete the plugin and assume the problem is resolved. The malware recreates backdoors on page visits. You need a full investigation: scan all plugin and theme files, audit WordPress admin accounts for accounts you did not create, check your database for injected content, rotate all WordPress and database credentials, and review server access logs for connections to rank1cdn[.]com.
-
If you cannot confirm you were not in the affected window, treat the site as potentially compromised and investigate accordingly. The cost of a false alarm is some investigative time. The cost of a missed compromise is significantly higher.
-
Enable automatic updates for WordPress core and plugins only where the update source is trustworthy and you have monitoring in place. Automatic updates are not inherently safe, as this incident demonstrates. They require oversight.
If you have H3C Magic NX15 hardware on your network:
-
Identify the firmware version currently running. Log into the router’s admin interface and find the firmware or software version information.
-
Check H3C’s support pages for the NX15 for any available firmware update that addresses CVE-2026-112370 and CVE-2026-112371. Apply the update immediately.
-
If no patch is available, assess whether the router’s administration interface is accessible from the internet. If it is, restrict access immediately. The attack is remotely exploitable.
-
Consider whether the device should remain in production if no patch is forthcoming. A router with a CVSS 9.9 vulnerability and a public exploit is not a suitable foundation for a business network.
-
Review your network hardware inventory. If you do not have a current list of what network devices are on your premises, what firmware they are running, and when they were last updated, build one. This is not a complex exercise, and it is the foundation of any sensible patching process.
If this briefing was useful, follow the show wherever you listen to it. A rating or review helps other small business owners find it. Drop a comment with what you are seeing on the ground, because the best intelligence often comes from people running actual businesses, not analyst reports. And if someone you know runs a WordPress site or has an H3C router on their network, send this to them. They may not know they need it yet.