Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level access. This allows such users to inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honour PHP directives, the injection can be chained with the user's own media upload (a polyglot image carrying a PHP payload) and an auto_prepend_file directive to achieve Remote Code Execution.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Yoast SEO Premium | before 27.6.1 | 27.6.1 | Patch available | CNA |
- Yoast SEO Premium VendorUnknown Affected before 27.6.1 Fixed in 27.6.1 Patch available CNA
Remediation
- Fix · CNA Yoast SEO Premium (Unknown) Fixed in 27.6.1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-10821
- 2026-10-03 Alias added: GHSA-2r8j-r49x-m28r
- 2026-10-25 EPSS moved to the 50th–90th percentile
References
Sources
- CVE-2026-10821 · CVE Program
- CVE-2026-10821 · NVD
- FIRST EPSS
- GHSA-2r8j-r49x-m28r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences