CVE-2026-10821

MediumCVSS 6.6

Published: 02/09/2026(UTC)Updated: 03/09/2026(UTC)Translated: 02/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.51%

42th percentile - higher than 42% of all known CVEs

Summary

The Yoast SEO Premium WordPress plugin before version 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level access. This allows such users to inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honour PHP directives, the injection can be chained with the user's own media upload (a polyglot image carrying a PHP payload) and an auto_prepend_file directive to achieve Remote Code Execution.

Risk Assessment

The risk includes the possibility of remote code execution by users with Author role, potentially leading to full server compromise and breach of confidentiality, integrity, and availability.

Recommendation

Immediately update the Yoast SEO Premium plugin to version 27.6.1 or later, which includes fixes for control character sanitization.

Other vulnerabilities in Yoast SEO Premium

CVE-2025-11241Medium
The Yoast SEO Premium plugin for WordPress versions 25.7 to 25.9 is vulnerable to stored XSS due to a flawed regex used to remove an attribute in post content. This can be abused to inject arbitrary HTML attributes, including JavaScript event handlers. A user with Contributor access or higher can create a post containing a malicious JavaScript payload.

Original NVD description (English source)

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level access. This allows such users to inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honour PHP directives, the injection can be chained with the user's own media upload (a polyglot image carrying a PHP payload) and an auto_prepend_file directive to achieve Remote Code Execution.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS