EUVD-2026-52578
GHSA-62v2-7mcm-qpm4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network upload endpoint (AV:N/PR:N/UI:N) with straightforward exploitation (AC:L) yielding webshell RCE, giving full C/I/A impact on the host.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achieve remote code execution.
Articles & Coverage 1
AnalysisAI
Unauthenticated remote code execution in the Improve SEO WordPress plugin (versions through 2.0.11) lets attackers upload executable PHP files by exploiting a file-upload routine that only validates MIME content type while writing files with the attacker-controlled extension into a web-accessible directory. Any visitor can drop a PHP webshell and execute arbitrary code on the server without credentials or user interaction. Publicly available exploit code exists (reported by WPScan), though the EPSS score is low (0.20%, 10th percentile) and it is not on CISA KEV.
Technical ContextAI
The affected component is Improve SEO, a WordPress plugin written in PHP, running inside the standard WordPress/PHP web-server stack (typically Apache or nginx with PHP-FPM). The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the plugin's upload handler inspects only the declared Content-Type/MIME of the submitted file rather than enforcing an allowlist of safe extensions, then persists the file using the attacker-supplied filename and extension into a directory that is directly reachable over HTTP. Because PHP files placed under the web root are executed by the interpreter on request, a file that passes the content-type check but carries a .php extension becomes a live server-side script. The CPE cpe:2.3:a:unknown:improve_seo:*:*:*:*:*:*:*:* confirms the affected application but leaves the vendor identity unresolved ('unknown').
RemediationAI
No vendor-released patched version is identified in the available data (no fix version is provided in the EUVD, NVD, or WPScan references), so treat this as unpatched until a fixed release above 2.0.11 is confirmed on the plugin's official page. As the primary compensating control, deactivate and remove the Improve SEO plugin until a fixed version ships, since the RCE is unauthenticated and a POC is public. If the plugin cannot be removed, restrict or block HTTP access to the plugin's upload endpoint and deny execution of PHP within the writable upload directory (for example, an Apache '<FilesMatch \.php$> Require all denied' rule or an nginx location that returns 403 for .php under the uploads path), and place a WAF rule in front of WordPress to block multipart uploads carrying a .php (or .phtml/.php5) filename regardless of declared Content-Type. Note trade-offs: disabling the plugin removes its SEO functionality, and directory-level PHP execution blocks can break legitimate features that rely on running scripts from that path, so test before deploying. Monitor the WPScan advisory (https://wpscan.com/vulnerability/3754d4c0-1b67-49a4-a29a-7169446638d1/) for a confirmed fixed release.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today