CVE-2026-10821: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in Yoast SEO Premium

The Yoast SEO Premium WordPress plugin prior to version 27.6.1 fails to sanitize control characters from redirect origins before writing them to the Apache .htaccess configuration file when file-based redirect mode is enabled. The redirect-creation endpoint is accessible to users with Author-level privileges, allowing such users to inject newline-delimited Apache directives. On Apache servers that process PHP directives, this injection can be combined with a user-uploaded polyglot image containing a PHP payload and an auto_prepend_file directive to achieve remote code execution. The CVSS 3.1 base score is 6.6, reflecting a medium severity with network attack vector, high privileges required, and high impact on confidentiality, integrity, and availability.

An attacker with Author-level access can inject arbitrary Apache directives into the root .htaccess file, potentially leading to remote code execution on vulnerable Apache servers configured to honor PHP directives. This compromises the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level user access to the redirect-creation endpoint and disable file-based redirect mode if possible to mitigate the risk of Apache directive injection.