CVE-2026-16618
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Improve SEO WordPress plugin through version 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory. This allows unauthenticated users to upload executable PHP files and achieve remote code execution.
Risk Assessment
The risk is critical: an unauthenticated attacker can take over the web server by executing arbitrary PHP code, potentially leading to full compromise of the site and data.
Recommendation
Immediately update the Improve SEO plugin to the latest version that fixes file validation, and restrict file upload capabilities to trusted users.
Original NVD description (English source)
The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achieve remote code execution.