The Yoast SEO Premium WordPress plugin before version 27.6.1 fails to sanitize control characters from redirect origins when file‑based redirect mode is enabled, allowing users with Author level access to inject arbitrary newline‑delimited Apache directives into the site’s .htaccess file. When the Apache server honours PHP directives, an attacker can chain the injected directives with a polyglot media upload that carries a PHP payload and an auto_prepend_file directive, leading to Remote Code Execution. This flaw is an example of control‑character injection, classified as CWE‑74.

WordPress sites that use Yoast SEO Premium older than 27.6.1 with file‑based redirect mode enabled are affected. The vulnerability is exploitable by any user who holds the Author role or higher, provided that the redirect‑creation endpoint is reachable and the attacker can upload media files.

The CVSS score is 6.6, indicating a moderate to high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires legitimate author credentials, access to the redirect‑creation endpoint, and the ability to upload files, but does not demand elevated system privileges or network access beyond normal WordPress operations. The attack vector is local to the website, leveraging the plugin’s input handling and the Apache configuration file.