EUVD-2026-54181
GHSA-r59p-4mh6-5r64
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Premium SEO plugin
-
DeliverySend unauthenticated request to backdoor endpoint
-
ExploitBackdoor creates hidden admin account
-
ExecutionAuthenticate as covert administrator
-
PersistExecute code or inject content (RCE builds)
-
ImpactFull site and server takeover
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Hidden functionality detection
|
| Exploitation Conditions | The single hard prerequisite is that the target WordPress site must have the Premium SEO plugin installed and active - the backdoor is dormant code that only exists on sites that installed this specific malicious plugin. Given that precondition, exploitation requires no authentication, no user interaction, and no special configuration (AV:N/AC:L/PR:N/UI:N): any remote attacker who reaches the site over the network and knows the backdoor trigger obtains administrator control. The RCE, SSRF, and arbitrary front-end injection capabilities are limited to 'some builds' per the description, so those specific impacts depend on which variant of the plugin is deployed; the hidden-admin-account behavior is described as universal to the plugin. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) reflects the worst case: remote, low-complexity, unauthenticated, scope-changing full compromise, which is consistent with a deliberate backdoor rather than an accidental bug. No EPSS score, KEV entry, or SSVC decision data was provided, so exploitation-probability and automatability signals cannot be corroborated - the risk rating rests on the CVSS vector and the WPScan description alone. Because the vulnerability IS a backdoor, the usual distinction between 'flaw exists' and 'flaw exploitable' collapses: presence of the plugin equals compromise-ready exposure. The tempering factor is reach - a malicious plugin must first be installed on the target, so real-world impact depends heavily on how widely this specific plugin was distributed, which is unknown from the data. |
| Exploit ScenarioDerived | An attacker who knows the Premium SEO backdoor endpoint sends a single unauthenticated HTTP request to a site running the plugin, triggering creation of a hidden administrator account; they then log in with full admin rights or, on an RCE-capable build, directly execute commands to drop a web shell. From there they pivot to SSRF against internal services or inject malicious scripts into front-end pages served to visitors. No public exploit code is identified, but the backdoor logic is self-contained in the plugin and requires no separate exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 06, 2026
Full unauthenticated site takeover in the Premium SEO WordPress plugin stems from an intentional backdoor shipped in the plugin code itself, which silently provisions a hidden administrator account and, in certain builds, exposes remote code execution, server-side request forgery, and arbitrary front-end content injection. Any WordPress site running this plugin is affected, and because the backdoor is reachable without authentication, an attacker who knows the endpoint gains complete control of the site. WPScan attributes the finding; no public exploit is identified at time of analysis and the CVE carries the maximum CVSS 10.0 score.
RemediationAI
No vendor-released patch is identified at time of analysis, and because the plugin is itself malicious, patching is not the remedy - remove it entirely. Immediately deactivate and delete the Premium SEO plugin from every WordPress installation, then audit wp_users for unexpected administrator accounts and delete any covert admin the backdoor created, rotate all administrator credentials and secret keys/salts, and review scheduled tasks, must-use plugins, theme functions, and uploaded files for secondary persistence since RCE-capable builds may have dropped additional web shells. Because SSRF and RCE may have been exercised, treat the host as potentially fully compromised: restore from a known-good backup predating installation where feasible, inspect outbound connections and access logs for indicators, and block the plugin's endpoints at the WAF as an interim control. Consult the WPScan advisory (https://wpscan.com/vulnerability/0115a640-7139-4ef9-81be-6ee5c755a601/) for specific file names and indicators of compromise.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is not a coding mistake in a legitimate plugin but a malicious/trojanized WordPress plugin: the vulnerable component is the plugin's own PHP execution path within the WordPress request lifecycle, which runs with the web server's privileges and full database access. The backdoor abuses WordPress user-management APIs (e.g. wp_insert_user/wp_create_user semantics) to create a covert administrator, and the reported RCE and SSRF behaviors indicate the code also passes attacker-controlled input into command/HTTP execution sinks. No CWE was assigned in the input, but the behavior maps to CWE-912 (hidden functionality/backdoor) with secondary CWE-94 (code injection) and CWE-918 (SSRF) for the affected builds. No CPE strings were provided, so exact affected plugin versions cannot be enumerated from structured data.
Know when WordPress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network-reachable backdoor grants full admin/RCE with no interaction, and server compromise beyond the WordPress app justifies S:C with C:H/I:H/A:H.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
DescriptionCVE.org
The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end script/content injection, giving an unauthenticated attacker full control of the affected site.
Executive ViewAI
The Premium SEO WordPress plugin contains an intentional backdoor that grants unauthenticated attackers complete administrative control of any affected WordPress site. Organizations running this plugin face immediate risk of data breach, malware injection, and business interruption. Rapid plugin removal and forensic assessment of all affected instances is critical.
No vendor-released patch identified at time of analysis. Interim mitigations pending complete removal: (1) disable the plugin immediately if full removal is not immediately feasible; (2) restrict network access to affected WordPress administration panels to known internal IP ranges; (3) implement Web Application Firewall rules to block requests to known backdoor endpoints if identified; (4) enable detailed audit logging and alerting on all administrator account creation and authentication events.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Exploit-DB