EUVD-2026-54181
GHSA-r59p-4mh6-5r64
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network-reachable backdoor grants full admin/RCE with no interaction, and server compromise beyond the WordPress app justifies S:C with C:H/I:H/A:H.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
2DescriptionCVE.org
The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end script/content injection, giving an unauthenticated attacker full control of the affected site.
AnalysisAI
Full unauthenticated site takeover in the Premium SEO WordPress plugin stems from an intentional backdoor shipped in the plugin code itself, which silently provisions a hidden administrator account and, in certain builds, exposes remote code execution, server-side request forgery, and arbitrary front-end content injection. Any WordPress site running this plugin is affected, and because the backdoor is reachable without authentication, an attacker who knows the endpoint gains complete control of the site. WPScan attributes the finding; no public exploit is identified at time of analysis and the CVE carries the maximum CVSS 10.0 score.
Technical ContextAI
This is not a coding mistake in a legitimate plugin but a malicious/trojanized WordPress plugin: the vulnerable component is the plugin's own PHP execution path within the WordPress request lifecycle, which runs with the web server's privileges and full database access. The backdoor abuses WordPress user-management APIs (e.g. wp_insert_user/wp_create_user semantics) to create a covert administrator, and the reported RCE and SSRF behaviors indicate the code also passes attacker-controlled input into command/HTTP execution sinks. No CWE was assigned in the input, but the behavior maps to CWE-912 (hidden functionality/backdoor) with secondary CWE-94 (code injection) and CWE-918 (SSRF) for the affected builds. No CPE strings were provided, so exact affected plugin versions cannot be enumerated from structured data.
RemediationAI
No vendor-released patch is identified at time of analysis, and because the plugin is itself malicious, patching is not the remedy - remove it entirely. Immediately deactivate and delete the Premium SEO plugin from every WordPress installation, then audit wp_users for unexpected administrator accounts and delete any covert admin the backdoor created, rotate all administrator credentials and secret keys/salts, and review scheduled tasks, must-use plugins, theme functions, and uploaded files for secondary persistence since RCE-capable builds may have dropped additional web shells. Because SSRF and RCE may have been exercised, treat the host as potentially fully compromised: restore from a known-good backup predating installation where feasible, inspect outbound connections and access logs for indicators, and block the plugin's endpoints at the WAF as an interim control. Consult the WPScan advisory (https://wpscan.com/vulnerability/0115a640-7139-4ef9-81be-6ee5c755a601/) for specific file names and indicators of compromise.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-912 – Hidden Functionality
View allShare
External POC / Exploit Code
Leaving vuln.today