CVE-2026-16618 is a critical vulnerability in the Improve SEO WordPress plugin (<=2.0.11) where the plugin fails to properly validate uploaded files. It only verifies the file content type but does not restrict the file extension, allowing attackers to upload executable PHP files. These files are stored in a publicly accessible directory, which can be leveraged by unauthenticated attackers to execute arbitrary code remotely on the affected system.

Successful exploitation allows unauthenticated attackers to achieve remote code execution on the affected system, which can lead to full system compromise, data theft, or further attacks. The vulnerability affects confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict file upload permissions and consider disabling the plugin if possible. Monitor for suspicious uploads and remove any unauthorized files from publicly accessible directories.