CVE-2026-10821Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE
Updated under an hour ago ()
Does this affect you?
It affects Unknown Yoast SEO Premium. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level access. This allows such users to inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honour PHP directives, the injection can be chained with the user's own media upload (a polyglot image carrying a PHP payload) and an auto_prepend_file directive to achieve Remote Code Execution.
- CVSS
- 6.6 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-74
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- WPScan
- NVD analysis
- Deferred
- Record last updated
- Sep 2, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Unknown Yoast SEO Premium unknown:yoast_seo_premium (from the name) | before 27.6.1 | CNA record |
References
- https://wpscan.com/vulnerability/2ddd8362-7248-48de-aab9-74c70e7d5dd6/exploit, vdb-entry, technical-description
- https://yoast.com/yoast-seo-premium-may-26-2026/vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.