CVE-2026-10821

Name of the Vulnerable Software and Affected Versions Yoast SEO Premium versions prior to 27.6.1

Description Insufficient sanitization of control characters from redirect origins occurs when file-based redirect mode is enabled. Users with Author-level access can reach the redirect-creation endpoint and inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honor PHP directives, this can be combined with a polyglot image (an image file containing a PHP payload) uploaded via the media library and an auto prepend file directive to achieve Remote Code Execution, which allows an attacker to execute arbitrary commands on the server.

Recommendations Update to version 27.6.1 or later.