CyberRota Analysis
AI-GeneratedThe Yoast SEO Premium WordPress plugin prior to version 27.6.1 is vulnerable due to insufficient sanitization of control characters in redirect origins, allowing users with Author-level access to inject arbitrary Apache directives into the site's .htaccess file. This vulnerability can lead to Remote Code Execution on Apache servers that process PHP directives, particularly when combined with a crafted media upload. WordPress site administrators and users of the Yoast SEO plugin should prioritize updating to the latest version to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level access. This allows such users to inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honour PHP directives, the injection can be chained with the user's own media upload (a polyglot image carrying a PHP payload) and an auto_prepend_file directive to achieve Remote Code Execution.