CVE-2026-10821: Yoast SEO Premium WordPress RCE Vulnerability

CVE-2026-10821 Overview

CVE-2026-10821 affects the Yoast SEO Premium WordPress plugin before version 27.6.1. The plugin fails to sanitize control characters from redirect origins before writing them to the site's Apache configuration file when file-based redirect mode is enabled. The redirect-creation endpoint is reachable by users with only Author-level access, allowing them to inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honor PHP directives, attackers can chain the injection with a polyglot image upload and an auto_prepend_file directive to achieve Remote Code Execution (RCE). The vulnerability is categorized under [CWE-74] Improper Neutralization of Special Elements in Output.

Critical Impact
Author-level WordPress users can escalate to Remote Code Execution on the underlying Apache server through .htaccess directive injection.

Affected Products

Yoast SEO Premium WordPress plugin versions before 27.6.1
WordPress installations running the plugin with file-based redirect mode enabled
Apache web servers configured to honor PHP directives via .htaccess

Discovery Timeline

2026-09-02 - CVE-2026-10821 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-10821

Vulnerability Analysis

The flaw resides in the redirect-management feature of Yoast SEO Premium. When administrators enable file-based redirect mode, the plugin writes redirect rules directly into the site's root .htaccess file. The plugin accepts redirect-origin input without stripping newline characters or other Apache control sequences.

Because the redirect-creation endpoint enforces only Author-level capability checks, low-privileged authenticated users can supply crafted input. Newline characters embedded in the origin field terminate the intended Redirect directive and allow attackers to append arbitrary configuration lines.

Root Cause

The root cause is missing sanitization of control characters, particularly \r and \n, in the redirect origin field before serialization to Apache configuration syntax. Combined with insufficient authorization on the redirect endpoint, this converts a content-editor role into an infrastructure configuration primitive.

Attack Vector

An authenticated Author-level user first uploads a polyglot media file that is a valid image but also contains an embedded PHP payload. The attacker then submits a crafted redirect entry containing a newline followed by an auto_prepend_file directive pointing to the uploaded image. Once written to .htaccess, Apache prepends and executes the PHP payload during any subsequent request, yielding Remote Code Execution under the web server context.

Detailed exploitation notes are available in the WPScan Vulnerability Report and the Yoast SEO Premium Announcement.

Detection Methods for CVE-2026-10821

Indicators of Compromise

Unexpected auto_prepend_file, php_value, or php_flag directives in the WordPress root .htaccess file
Media library files with image extensions but PHP tags (<?php) in their byte content
Redirect entries in Yoast SEO Premium configuration containing embedded newline or carriage-return characters
Web server processes executing PHP from paths inside wp-content/uploads

Detection Strategies

Compare the current .htaccess file against a known-good baseline and flag any lines outside the Yoast-managed block markers
Scan uploaded media files for PHP tags or executable magic bytes indicating polyglot content
Audit WordPress user activity logs for redirect creation actions performed by non-administrator accounts

Monitoring Recommendations

Alert on modifications to .htaccess files under any WordPress document root
Monitor Apache error and access logs for requests that trigger execution of files inside upload directories
Track Yoast SEO redirect database entries and configuration files for changes containing control characters

How to Mitigate CVE-2026-10821

Immediate Actions Required

Update Yoast SEO Premium to version 27.6.1 or later on all WordPress installations
Inspect the site's .htaccess file for injected directives and restore from a trusted backup if tampering is confirmed
Audit and remove suspicious media uploads, especially image files containing PHP code
Review and reduce Author-level accounts to the minimum required

Patch Information

Yoast released version 27.6.1 addressing the sanitization gap. Refer to the Yoast SEO Premium Announcement for release details and to the WPScan Vulnerability Report for advisory information.

Workarounds

Disable file-based redirect mode in Yoast SEO Premium and use PHP-based redirects until the plugin is patched
Configure Apache to ignore .htaccess overrides for PHP directives by setting AllowOverride to exclude Options and FileInfo where feasible
Restrict Author-level accounts and require higher privileges for any redirect management workflow
Enforce upload filters that reject files containing PHP tags regardless of extension

bash

# Example Apache hardening to prevent .htaccess PHP directive abuse
<Directory /var/www/html>
    AllowOverride FileInfo Indexes Limit AuthConfig
    php_admin_flag engine off
</Directory>

<Directory /var/www/html/wp-content/uploads>
    php_admin_flag engine off
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>