Yoast SEO Premium CVE-2026-10821

Three specific conditions must all be true simultaneously: (1) Yoast SEO Premium before 27.6.1 is installed and active; (2) file-based redirect mode is explicitly enabled in the plugin's redirect manager - this is a non-default configuration that must be deliberately activated by an administrator; (3) the site runs on Apache with PHP directive processing active (mod_php, PHP-FPM with .htaccess INI override support, or equivalent - not nginx, which ignores .htaccess). The attacker must hold at least WordPress Author-level credentials, allowing both access to the redirect-creation endpoint and standard media file uploads. Exploitation is constrained by the Author role requirement (rules out anonymous attackers), the Apache+PHP-directives stack requirement (rules out nginx and IIS deployments), and the non-default file-based redirect mode (rules out sites using the plugin's default redirect storage).

The provided CVSS vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H conflicts internally with the description: PR:H (high privileges) is inconsistent with exploitation by Author-level WordPress users, who represent a low-privilege authenticated role (PR:L). This discrepancy causes the published score of 6.6 to understate risk for sites where Authors are untrusted third parties (e.g., multi-author blogs, content platforms). AC:H is accurate because three specific conditions must simultaneously hold: file-based redirect mode enabled, Apache with PHP-directive processing, and attacker possession of at least Author credentials. No CISA KEV listing is present, and EPSS data was not provided, so mass-exploitation evidence is absent. However, a public exploit published by WPScan substantially lowers the operational barrier, and the chained impact is full server compromise (C:H/I:H/A:H), making this a high-priority patch for any multi-author WordPress site running on Apache with file-based redirects enabled.

An attacker with WordPress Author credentials submits a redirect origin containing a URL-encoded newline sequence followed by a PHP auto_prepend_file Apache directive targeting the attacker's upload directory path. The plugin writes this unsanitized string to .htaccess, embedding the directive. The attacker then uploads a valid-header JPEG file whose trailing bytes contain a PHP webshell via WordPress's standard media upload interface; on the next HTTP request to any page on the site, Apache's PHP handler pre-executes the polyglot file, granting the attacker a shell as the web server user. A public PoC referenced via WPScan (https://wpscan.com/vulnerability/2ddd8362-7248-48de-aab9-74c70e7d5dd6/) confirms the feasibility of this chain.