CVE-2026-10821: Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE
The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level access. This allows such users to inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honour PHP directives, the injection can be chained with the user's own media upload (a polyglot image carrying a PHP payload) and an autoprependfile directive to achieve Remote Code Execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Yoast SEO Premium WordPress pluginto a version that resolves this vulnerability.Fixed in 27.6.1 - Configuration
Ensure the Apache/PHP directive auto_prepend_file is not configured (or is removed) on Apache servers that honor PHP directives to prevent the documented directive-chaining path to RCE.
Apache (honors PHP directives) auto_prepend_file = disable/avoid (remove the directive or ensure it is not set so PHP prepend chaining cannot be used for RCE) - Configuration
If you use Yoast SEO Premium's file-based redirect mode, disable it to prevent creation of redirects via the reachable redirect-creation endpoint that permits newline-delimited directive injection into the site's Apache configuration/.htaccess.
Yoast SEO Premium WordPress plugin (file-based redirect mode) file-based redirect mode = disabled (not enabled)
Event History
Frequently Asked Questions
Which deployments are exposed to remote code execution?
Remote code execution requires Yoast SEO Premium before 27.6.1, file-based redirect mode enabled, and an Apache server that honours PHP directives. The described chain also requires an Author-level account to create a redirect and upload a polyglot image containing a PHP payload.
What level of access does an attacker need?
The redirect-creation endpoint is reachable to users with Author-level access. An attacker does not need administrator access, but must be able to use an Author account to create the malicious redirect and upload media for the RCE chain.
Is the vulnerable behavior limited to redirect configuration?
The injected content is written as arbitrary newline-delimited Apache directives into the root .htaccess file. This can affect more than redirect handling because the attacker can add Apache directives beyond the intended redirect entry.
What conditions reduce exposure if the plugin cannot be updated immediately?
The described injection path depends on file-based redirect mode being enabled. The RCE chain additionally depends on Apache honoring PHP directives; deployments without that behavior do not meet the stated conditions for this code-execution path.