PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10821 Yoast CVE debrief

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level access. This allows such users to inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honour PHP directives, the injection can be chained with the user's own media upload (a polyglot image carrying a PHP payload) and an auto_prepend_file directive to achieve Remote Code Execution. The vulnerability affects WordPress site administrators and security teams responsible for monitoring and patching vulnerabilities in WordPress plugins. Limited detail is available on exploitability and affected scope. Defenders should verify Apache configuration file integrity, monitor for suspicious changes, and review media upload and PHP execution controls. AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-09-02T15:17:37.267Z and has not been modified since then. The NVD entry is currently Deferred. Users of Yoast SEO Premium plugin, WordPress site administrators, and security teams responsible for monitoring and patching vulnerabilities in WordPress plugins should review and apply vendor patches or updates. They should also restrict access to the redirect-creation endpoint and monitor Apache configuration files for suspicious changes.

Vendor
Yoast
Product
Yoast SEO Premium
CVSS
MEDIUM 6.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-02
Original CVE updated
2026-09-03
Advisory published
2026-09-02
Advisory updated
2026-09-03

Who should care

Users of Yoast SEO Premium plugin, WordPress site administrators, and security teams responsible for monitoring and patching vulnerabilities in WordPress plugins should review and apply vendor patches or updates. They should also restrict access to the redirect-creation endpoint and monitor Apache configuration files for suspicious changes.

Technical summary

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file. This allows Author-level users to inject arbitrary newline-delimited Apache directives into the root .htaccess file, potentially leading to Remote Code Execution on Apache servers that honour PHP directives. The vulnerability affects WordPress site administrators and security teams responsible for monitoring and patching vulnerabilities in WordPress plugins.

Defensive priority

Medium-priority defensive review recommended due to potential for Remote Code Execution via Apache configuration file injection.

Recommended defensive actions

  • Review and apply vendor patches or updates for Yoast SEO Premium plugin
  • Restrict access to the redirect-creation endpoint
  • Monitor Apache configuration files for suspicious changes
  • Implement compensating controls for media uploads and PHP execution
  • Review Apache configuration file permissions and integrity
  • Monitor for suspicious media uploads and PHP execution attempts
  • Track exceptions and retest remediated assets

Evidence notes

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level access. Evidence from WPScan and Yoast indicates that the Yoast SEO Premium plugin is affected. Limited detail available on exploitability and affected scope. Defenders should verify Apache configuration file integrity, monitor for suspicious changes, and review media upload and PHP execution controls.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10821 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10821

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10821 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10821

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.