CVE-2026-16618 — ImproveSEO <= 2.0.11 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution

CVE-2026-16618

ImproveSEO <= 2.0.11 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution PUBLISHED

Description (CNA)

The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achieve remote code execution.

Affected (CNA)

Vendor / product	Versions
Unknown / Improve SEO	affected 0 through 2.0.11

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/3754d4c0-1b67-49a4-a29a-7169446638d1/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.