Description

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level access. This allows such users to inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honour PHP directives, the injection can be chained with the user's own media upload (a polyglot image carrying a PHP payload) and an auto_prepend_file directive to achieve Remote Code Execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-09-02T15:17:37.267Z",
  "pubdate": "2026-09-02T15:17:37.267Z",
  "executiveSummary": "The Yoast SEO Premium WordPress plugin, in versions prior to 27.6.1, contains a critical vulnerability involving improper neutralization of special elements used in an OS command (CWE-78). The flaw exists within the redirect management functionality, specifically when configured for file-based redirect storage.\nBy failing to sanitize control characters within the redirect origin field, the application permits an authenticated user with Author-level privileges to perform arbitrary directive injection into the site's root .htaccess file. This capability significantly elevates the risk profile, as an attacker can manipulate the Apache server's configuration to execute unauthorized code.\nThe primary impact of this vulnerability is Remote Code Execution (RCE). An attacker can chain this injection with secondary vectors, such as the upload of a malicious polyglot image, to force the server to execute arbitrary PHP code via directives like auto_prepend_file. Because the vulnerability is accessible to the Author role—a common user tier in WordPress environments—it poses a severe risk to site integrity and server-side security. Successful exploitation grants the attacker full control over the WordPress application and potential access to the underlying server environment, depending on server-level permissions and configuration.\nImmediate remediation involves updating the plugin to version 27.6.1 or higher and auditing existing .htaccess files for unauthorized modifications.",
  "technicalDetails": "The vulnerability resides in the redirect creation mechanism of the Yoast SEO Premium plugin. When file-based redirects are enabled, the plugin writes redirect rules directly into the site's .htaccess file. The flaw is rooted in the plugin's failure to sanitize control characters—specifically newline characters—within the 'origin' parameter of a redirect request before appending the data to the target configuration file.\nBecause the redirect-creation endpoint is reachable by users with the 'Author' capability, an attacker can supply malicious input containing carriage return (\\r) and line feed (\\n) sequences. These control characters allow an attacker to escape the intended context of the rewrite rule and inject new, arbitrary lines into the .htaccess file. Since the .htaccess file is parsed by the Apache web server to dictate per-directory configuration, the attacker effectively gains the ability to redefine server behavior at the application root.\nThe exploitation flow typically proceeds as follows: First, the attacker uploads a polyglot file, which is a legitimate image file containing embedded, valid PHP code within its metadata or binary stream. Second, the attacker uses the vulnerable redirect endpoint to inject Apache directives into the .htaccess file. A common payload involves using the 'php_value' directive to set 'auto_prepend_file' to point to the path of the previously uploaded polyglot image. This forces the Apache server to interpret the contents of the image as PHP code during the initialization of every request.\nBy chaining these actions, the attacker forces the server to execute the malicious PHP payload hidden within the image file, leading to full Remote Code Execution (RCE) within the context of the web server process. The vulnerability is highly effective on Apache servers configured to honor PHP directives defined in local configuration files. This attack does not require elevated administrative privileges, making it a significant concern for multi-author WordPress installations. The impact includes, but is not limited to, data exfiltration, total site compromise, and the potential for lateral movement within the server environment. The attack is limited to environments using the file-based redirect mode, but as this is a standard configuration feature, the attack surface remains broad."
}