CVE-2026-14812 describes a critical security vulnerability in the Premium SEO WordPress plugin. The plugin ships with a hidden backdoor that does not require authentication, allowing attackers to create concealed administrator accounts. Additionally, certain builds of the plugin permit remote code execution, server-side request forgery, and arbitrary injection of scripts or content into the front end. This combination of issues results in complete compromise of the affected WordPress site by unauthenticated attackers. The vulnerability is classified under CWE-912 (Hidden Functionality).

An unauthenticated attacker can gain full administrative control over the affected WordPress site. This includes the ability to execute arbitrary code remotely, perform server-side request forgery attacks, and inject malicious scripts or content into the website's front end. Such control can lead to site defacement, data theft, malware distribution, and further network compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been documented at this time. Until a patch is available, it is recommended to discontinue use of the affected Premium SEO plugin and monitor official vendor channels for updates. Consider removing the plugin from production environments to prevent exploitation.