CVE-2026-10821
Received Received - Intake

Yoast SEO Premium WordPress Plugin Apache Configuration Injection

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: WPScan

Description
The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level access. This allows such users to inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honour PHP directives, the injection can be chained with the user's own media upload (a polyglot image carrying a PHP payload) and an auto_prepend_file directive to achieve Remote Code Execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-10821
EUVD
EUVD-2026-70033

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
yoast seo_premium to 27.6.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Yoast SEO Premium WordPress plugin before version 27.6.1. It allows authenticated users with Author-level access to inject malicious Apache directives into the site's .htaccess file by exploiting improper sanitization of control characters in redirect origins. This can lead to remote code execution if chained with a polyglot image upload and specific server configurations.

Detection Guidance

Check if you are running Yoast SEO Premium version before 27.6.1 by visiting WordPress admin panel > Plugins. Verify if file-based redirect mode is enabled by going to SEO > Redirects > Settings. Inspect the root .htaccess file for unexpected newline-delimited Apache directives or unusual PHP-related entries.

Impact Analysis

An attacker could exploit this to execute arbitrary code on your server, potentially taking full control of your WordPress site. It may also allow site crashes or unauthorized access to sensitive data. The impact depends on server configurations and whether file-based redirect mode is enabled.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Update Yoast SEO Premium to version 27.6.1 or later immediately via WordPress plugins screen. Disable file-based redirect mode if not required. Review .htaccess for unauthorized changes and remove any suspicious directives. Restrict Author-level user permissions to reduce attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-10821. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart