CVE-2026-16618: 
WordPress vulnerability analysis and mitigation

CVE-2026-16618 is an unauthenticated arbitrary file upload vulnerability in the Improve SEO WordPress plugin (versions through 2.0.11) that allows remote attackers to upload executable PHP files and achieve remote code execution. The vulnerability was publicly disclosed on July 24, 2026, and was discovered and reported by researcher João Ramos Maciel of treesec.com.br (WPScan). It was published to the NVD and GitHub Advisory Database on August 4, 2026 (Github Advisory). The CVSS base score has not been formally assigned yet, though Feedly estimates the severity as HIGH; the EPSS score is currently 0.0.

The root cause is improper file upload validation (CWE-434: Unrestricted Upload of File with Dangerous Type). The plugin validates only the MIME/content type of uploaded files but does not validate or restrict the file extension, allowing an attacker to supply a .php extension while satisfying the content-type check (WPScan). The resulting file is written with the attacker-controlled extension into a publicly accessible directory on the web server, making it directly accessible and executable via HTTP. No authentication is required to trigger the upload endpoint, making this exploitable by any unauthenticated remote user.

Successful exploitation grants an unauthenticated attacker the ability to execute arbitrary PHP code on the web server, effectively achieving full remote code execution (RCE) (WPScan, Github Advisory). This can lead to complete compromise of the WordPress site, including theft of database credentials, user data, and sensitive configuration files. An attacker could also use the compromised server as a pivot point for lateral movement within the hosting environment or to deploy malware, cryptominers, or phishing pages.

1. Reconnaissance: Identify WordPress sites running the Improve SEO plugin (version ≤ 2.0.11) using tools like WPScan, Shodan, or by inspecting plugin directories at /wp-content/plugins/improveseo/.
2. Locate the upload endpoint: Identify the file upload functionality exposed by the plugin, typically an unauthenticated HTTP endpoint that accepts file uploads.
3. Craft the malicious request: Prepare a PHP web shell file (e.g., shell.php) containing arbitrary PHP code. Set the HTTP Content-Type header to a permitted MIME type (e.g., image/jpeg) to pass the plugin's content-type validation, while keeping the filename extension as .php.
4. Upload the file: Submit the crafted multipart HTTP POST request to the plugin's upload endpoint without any authentication credentials.
5. Execute the web shell: Access the uploaded file directly via its public URL (e.g., https://target.com/wp-content/uploads/improveseo/shell.php) to execute arbitrary PHP commands on the server (WPScan).

• Network: Unauthenticated HTTP POST requests to the Improve SEO plugin's upload endpoint with a Content-Type of an image or document MIME type but a .php file extension in the filename parameter; subsequent GET requests to PHP files in the plugin's upload directory.
• File System: Unexpected .php files in the plugin's upload directory (e.g., /wp-content/uploads/improveseo/ or similar); web shell files with names resembling images (e.g., image.php, shell.php).
• Logs: Web server access logs showing POST requests to the plugin upload handler followed by GET requests to newly created .php files in publicly accessible directories; PHP error logs showing execution of unusual commands.
• Process: Unusual child processes spawned by the web server process (e.g., Apache or Nginx spawning bash, curl, wget, or python) indicating web shell command execution.

There is currently no known fixed version of the Improve SEO plugin available; the WPScan advisory notes "No known fix" as of the disclosure date (WPScan). Site administrators should consider deactivating and removing the plugin until a patched version is released. As interim mitigations: configure the web server to deny execution of PHP files in upload directories (e.g., via .htaccess rules or Nginx location blocks); implement a Web Application Firewall (WAF) rule to block suspicious file uploads; and restrict write permissions on upload directories. Monitor the plugin's WordPress.org page and WPScan for patch availability.