The vulnerability resides in the Improve SEO WordPress plugin for versions up to 2.0.11, where the upload mechanism does not enforce strict file type validation. The plugin accepts any file based solely on MIME type, then writes the file to a publicly accessible directory using the attacker‑supplied extension. This flaw allows an unauthenticated user to upload a PHP file that can be executed by the web server, resulting in remote code execution. The impact is full compromise of the affected WordPress installation, including potential data exfiltration, defacement, or further compromise of the underlying server.

All installations running the Improve SEO plugin version 2.0.11 or earlier on WordPress are affected, regardless of specific WordPress core versions or hosting environment. The plugin is hosted under the wp‑content/plugins/improve‑seo directory and all uploaded files are stored under the plugin’s public upload folder, which is directly accessible via the web. No additional components are necessary to trigger the vulnerability – any user with access to the site’s public HTTP interface can submit an upload request.

The EPSS score is < 1%, indicating a very low probability of exploitation. The vulnerability is not currently listed in CISA’s KEV catalog. The CVSS score of 9.8 indicates a critical severity. Because the flaw can be exploited by unauthenticated users without any pre‑existing privileges, the risk remains significant until remediation. Attackers could gain full control of the site, install backdoors, or exfiltrate sensitive data. Due to the lack of any publicly disclosed exploits seen thus far, the likelihood of immediate widespread exploitation is uncertain, but the high severity warrants prompt action.