Improve SEO permits unauthenticated executable PHP uploads
Improve SEO through 2.0.11 validates an uploaded file's reported content type but preserves the attacker-supplied extension when writing it into a publicly accessible directory. An unauthenticated attacker can therefore upload a PHP file and request the resulting public URL to execute code on the server. The public advisory withholds its proof of concept and does not disclose the upload endpoint, field name, destination path or URL pattern.
- Component
- Improve SEO
- Plugin slug
improve-seo- Affected
- <= 2.0.11
- Safe version
> 2.0.11- Published
- Aug 04, 2026
This CVE was published Aug 04, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
Update to a corrected Improve SEO release newer than 2.0.11 when available. Until then, disable the plugin, prevent PHP execution in upload directories, remove unexpected executable files and investigate requests to uploaded PHP files.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achieve remote code execution.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H