This is a critical file upload vulnerability in a WordPress SEO plugin that allows remote code execution. The plugin validates the uploaded file's content-type (checking for image types like image/jpeg) but preserves the original filename extension supplied by the attacker. This means uploading a file named shell.php with a content-type of image/jpeg succeeds—the plugin stores shell.php on disk, and the webserver then executes it as PHP.
The vulnerability is straightforward: extension validation is missing entirely. The developer checked what the file claims to be (MIME type) but not what the file is named. Since web servers determine how to handle a file based on extension, not content-type, the attacker gets code execution by uploading a .php file with a spoofed MIME header.
Check your WordPress plugin directory for any custom upload handlers. If you maintain a plugin with file upload functionality, ensure you're validating the extension against an allowlist (not just checking MIME type), and prefer WordPress core functions like wp_handle_upload() or wp_check_filetype_and_ext() which perform extension-plus-MIME validation atomically. These functions also enforce storage in the uploads directory with protections against direct execution.
The CVSS 9.8 score reflects the severity: this is pre-authentication, requires no user interaction, and yields immediate remote code execution. The SEO plugin context amplifies impact—these plugins often run on sites where marketing teams have admin access, and the database credentials on the same server grant attackers access to sensitive data across the application.
If you cannot immediately patch, disable file upload features in affected plugins, or restrict upload directory execution via .htaccess (AddType application/x-httpd-php .php in a <FilesMatch> block to deny PHP execution in uploads folders). Monitor your access logs for POST requests to the uploads directory with .php extensions.