Vulnerability · Published Sep 2, 2026 · Assigned by WPScan

CVE-2026-10821Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE

Medium 6.6

In plain English

A medium-severity injection in Yoast SEO Premium from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.1)6.6Medium

Exploit odds (30 days)0.7%top 46.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level access. This allows such users to inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honour PHP directives, the injection can be chained with the user's own media upload (a polyglot image carrying a PHP payload) and an auto_prepend_file directive to achieve Remote Code Execution.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Yoast SEO Premium	0 – before 27.6.1

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/2ddd8362-7248-48de-aab9-74c70e7d5dd6/ exploit, vdb-entry, technical-description
https://yoast.com/yoast-seo-premium-may-26-2026/ vendor-advisory