Arbitrary Code Execution Vulnerability in Yoast SEO Premium Plugin for WordPress
CVE-2026-10821

6.6MEDIUM

Key Information:

Vendor

WordPress
Status
Yoast Seo Premium
Vendor
CVE Published:
2 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-10821?

The Yoast SEO Premium WordPress plugin prior to version 27.6.1 exhibits a security flaw where it fails to properly sanitize control characters from redirect origins before writing to the site's Apache configuration file. This issue arises when file-based redirection is enabled and the redirect-creation endpoint is accessible to users with Author-level permissions. As a result, these users can inject malicious newline-delimited Apache directives into the site's root .htaccess file. If the Apache server processes PHP directives, the vulnerabilities can be exploited in conjunction with a user's media uploads (e.g., a specially crafted polyglot image containing a PHP payload) combined with an auto_prepend_file directive, potentially leading to Remote Code Execution.

Affected Version(s)

Yoast SEO Premium 0 < 27.6.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-10821 - Proof of Concept

References

https://wpscan.com/vulnerability/2ddd8362-7248-48de-aab9-...
exploitvdb-entrytechnical-description
https://yoast.com/yoast-seo-premium-may-26-2026/
vendor-advisory

CVSS V3.1

Score:
6.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tin Pham (TF1T)
Trong Pham (dtro)
Hao Ngo
WPScan
.