Executive brief
Yoast SEO Premium is a WordPress plugin that manages redirects and search engine optimization for websites. An authenticated user with basic post-editing privileges can inject malicious Apache configuration directives into the site's .htaccess file by including special characters in a redirect URL. On servers configured to use file-based redirects (a non-default setting), this can escalate to remote code execution, allowing an attacker to run arbitrary PHP code and fully compromise the website.
Technical details
This vulnerability stems from insufficient sanitization of control characters (newlines, carriage returns) in redirect origin fields before writing them to the Apache .htaccess configuration file. The vulnerability requires three preconditions: (1) the target site must use Apache with file-based redirects enabled (non-default configuration), (2) an authenticated user with edit_posts capability (Author role or above), and (3) a writable root .htaccess file. The regex-redirect endpoint bypasses origin validation, allowing CR/LF injection. An attacker can chain this with a polyglot PHP/PNG file upload to inject an auto_prepend_file directive, achieving pre-execution of arbitrary PHP code on every request. Yoast patched this in version 27.6.1 by stripping control characters from redirect fields, removing the vulnerable endpoint, and adding in-plugin detection for anomalous .htaccess modifications.
Affected products
- Yoast SEO Premium before 27.6.1
Timeline
- 2026-06-04: disclosed
- 2026-05-26: patched: Version 27.6.1 released
- 2026-09-02: advisory