CVE-2026-14812

Published: Aug 6, 2026Modified: Aug 26, 2026Deferred

10.0

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 6.0

Source: contact@wpscan.com (Secondary)

Description

The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end script/content injection, giving an unauthenticated attacker full control of the affected site.

Related CWEs

CWE-912

Hidden Functionality

The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.

References (1)

https://wpscan.com/vulnerability/0115a640-7139-4ef9-81be-6ee5c755a601/

Source: contact@wpscan.com

Timeline

No history available yet.