critical9.8
CVE-2026-16618
The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the …
Impact
The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achieve remote code execution.
Affected products
| Product | Affected versions |
|---|---|
| Improve SEO WordPress Plugin | through 2.0.11 |
Versions were read from the advisory text. No structured product data has been published for this record yet.