Executive brief
A vulnerability in a popular WordPress SEO plugin allows unauthorized users to upload files to the website's server. While the system prevents the upload of dangerous scripts like PHP, an attacker could still use the site to host unauthorized content (such as PDFs or ZIP files) or fill up the server's storage space. This could lead to reputational damage or increased hosting costs.
Technical details
The vulnerability exists in the frontend AJAX file-upload handlers `saswp_rf_form_image_upload` and `saswp_rf_form_video_upload`. The plugin fails to perform `current_user_can()` checks and relies on client-supplied 'Content-Type' headers for validation rather than verifying actual file content. While WordPress core's default filters prevent the upload of executable files (like .php or .html), unauthenticated attackers can upload any file type permitted by the media library (e.g., .zip, .pdf, .csv, .json). This can be used for hosting malicious payloads or performing a denial-of-service attack via disk exhaustion. The issue is fixed in version 1.60.
Affected products
- Magazine3 Schema & Structured Data for WP & AMP < 1.60
Timeline
- 2026-05-20: disclosed: Vulnerability details published by WPScan
- 2026-05-20: patched: Fixed in version 1.60
- 2026-06-10: advisory: CVE-2026-9067 published to NVD