CVE-2026-14812
CriticalCVSS 10.0Summary
The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end script/content injection, giving an unauthenticated attacker full control of the affected site.
Risk Assessment
An attacker can gain full control of the WordPress site, leading to data theft, defacement, malware distribution, and loss of user trust.
Recommendation
Immediately remove the Premium SEO plugin and scan the site for unauthorized admin accounts and suspicious files. Change all passwords and API keys.
Original NVD description (English source)
The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end script/content injection, giving an unauthenticated attacker full control of the affected site.