Remote Code Execution (RCE)

yoast/wordpress-seo is vulnerable to remote code execution. An SEO Manager is able to execute arbitrary OS commands via a ZIP import through a race condition vulnerability in unzipfile in admin/import/class-import-settings.php...

CVE-2018-19370

A Race condition vulnerability in unzipfile in admin/import/class-import-settings.php in the Yoast SEO wordpress-seo plugin before 9.2.0 for WordPress allows an SEO Manager to perform command execution on the Operating System via a ZIP import...

CVE-2018-19370: Concurrent Execution using Shared Resource with Improper Synchronization

A Race condition vulnerability in unzipfile in admin/import/class-import-settings.php in the Yoast SEO wordpress-seo plugin before 9.2.0 for WordPress allows an SEO Manager to perform command execution on the Operating System via a ZIP import...

PT-2018-14943

Name of the Vulnerable Software and Affected Versions Yoast SEO wordpress-seo plugin versions prior to 9.2.0 Description A race condition issue in the unzip file function within the admin/import/class-import-settings.php file of the Yoast SEO plugin allows an SEO Manager to execute commands on th...