{"id":"CVE-2026-10821","aliases":["EUVD-2026-70033","GHSA-2r8j-r49x-m28r"],"status":"published","title":"Yoast SEO Premium \u003c 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE","description":"The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level access. This allows such users to inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honour PHP directives, the injection can be chained with the user's own media upload (a polyglot image carrying a PHP payload) and an auto_prepend_file directive to achieve Remote Code Execution.","severity":{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00704,"percentile":0.53792,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-74"],"published":"2026-09-02T14:16:44Z","modified":"2026-09-03T17:50:37Z","products":[{"vendor":"unknown","product":"yoast seo premium"}],"references":[{"url":"https://wpscan.com/vulnerability/2ddd8362-7248-48de-aab9-74c70e7d5dd6/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://yoast.com/yoast-seo-premium-may-26-2026/","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10821"},{"url":"https://wpscan.com/vulnerability/2ddd8362-7248-48de-aab9-74c70e7d5dd6"},{"url":"https://yoast.com/yoast-seo-premium-may-26-2026"},{"url":"https://github.com/advisories/GHSA-2r8j-r49x-m28r"}],"sources":{"cve":[{"id":"CVE-2026-10821","title":"Yoast SEO Premium \u003c 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE","description":"The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level access. This allows such users to inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honour PHP directives, the injection can be chained with the user's own media upload (a polyglot image carrying a PHP payload) and an auto_prepend_file directive to achieve Remote Code Execution.","status":"published","published":"2026-09-02T14:16:44.007Z","modified":"2026-09-02T14:57:38.69Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T13:40:01.309549Z"}],"euvd":[{"id":"EUVD-2026-70033","description":"The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level access. This allows such users to inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honour PHP directives, the injection can be chained with the user's own media upload (a polyglot image carrying a PHP payload) and an auto_prepend_file directive to achieve Remote Code Execution.","status":"published","published":"2026-09-02T14:16:44Z","modified":"2026-09-02T14:57:38Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T18:01:15.49101Z"}],"ghsa":[{"id":"GHSA-2r8j-r49x-m28r","title":"The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from...","description":"The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level access. This allows such users to inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honour PHP directives, the injection can be chained with the user's own media upload (a polyglot image carrying a PHP payload) and an auto_prepend_file directive to achieve Remote Code Execution.","status":"published","published":"2026-09-02T15:34:48Z","modified":"2026-09-02T15:34:49Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:11:16.730606Z"}],"nvd":[{"id":"CVE-2026-10821","description":"The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level access. This allows such users to inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honour PHP directives, the injection can be chained with the user's own media upload (a polyglot image carrying a PHP payload) and an auto_prepend_file directive to achieve Remote Code Execution.","status":"published","published":"2026-09-02T15:17:37.267Z","modified":"2026-09-03T17:50:37.69Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:12:43.399612Z"}]}}