Description

The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end script/content injection, giving an unauthenticated attacker full control of the affected site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-06T22:16:46.967Z",
  "pubdate": "2026-08-06T22:16:46.967Z",
  "executiveSummary": "The Premium SEO WordPress plugin contains a critical malicious backdoor vulnerability that exposes affected websites to complete system compromise. The vulnerability type encompasses an unauthenticated backdoor mechanism combined with multiple high-severity attack vectors, including remote code execution, server-side request forgery, and arbitrary front-end script and content injection.\nThe impact of this vulnerability is catastrophic, granting an unauthenticated malicious actor full administrative control over the underlying WordPress site. Affected systems are limited to instances running vulnerable builds of the Premium SEO WordPress plugin.\nThe risk implications include total loss of confidentiality, integrity, and availability of the web application and its database, as well as potential pivoting capabilities into internal networks via server-side request forgery. Attacker capabilities require zero prior authentication or privileges, enabling remote exploitation over the network simply by interacting with the exposed components of the vulnerable plugin.\nNo complex exploitation requirements are necessary beyond network reachability to the targeted WordPress installation, making the threat highly severe and easily automatable by malicious actors.",
  "technicalDetails": "The root cause of the vulnerability stems from malicious code natively shipped within the Premium SEO WordPress plugin builds. The vulnerable component consists of unauthorized backdoor scripts integrated directly into the plugin codebase, bypassing standard WordPress authentication and authorization checks.\nThe exploitation method relies on unauthenticated network requests sent directly to the exposed vulnerable component. Because the backdoor lacks any cryptographic or credential-based access controls, any remote attacker across the network can interact with the plugin's execution flow without requiring valid user sessions or administrative privileges.\nThe attack flow proceeds in several distinct stages. First, the unauthenticated attacker sends a crafted HTTP request to the vulnerable endpoint exposed by the Premium SEO WordPress plugin. Second, the backdoor routine executes automatically, processing the supplied parameters without validation. Third, depending on the specific build of the plugin, the payload execution triggers the creation of a hidden rogue administrator account within the WordPress database, ensuring persistent access.\nIn addition to unauthorized privilege escalation via hidden administrator account creation, certain builds of the plugin execute secondary malicious payloads. These include remote code execution capabilities allowing the execution of arbitrary system commands or PHP code on the server, server-side request forgery enabling the server to make unauthorized outbound requests to internal or external resources, and arbitrary front-end script and content injection to deface pages or execute malicious JavaScript in the context of site visitors' browsers.\nThe post-exploitation impact provides the attacker with full control over the affected site, allowing complete data exfiltration, malware hosting, SEO spam injection, and further compromise of the hosting infrastructure."
}