Remote Code Execution via settings ZIP import in Yoast SEO
The Yoast SEO settings import extracted every file from an uploaded ZIP archive into a web-accessible uploads folder and only removed it afterwards. A user with the SEO Manager role could put a PHP file in the archive and run it on the server during that window. The patch stops extracting the archive to disk and imports the settings text directly.
This vulnerability affects the following application versions:
- Yoast SEO 1.5.4.2
- Yoast SEO 1.5.5
- Yoast SEO 1.5.5.1
- Yoast SEO 1.5.5.2
- Yoast SEO 1.5.5.3
- Yoast SEO 1.5.6
- Yoast SEO 1.6
- Yoast SEO 1.6.1
- Yoast SEO 1.6.2
- Yoast SEO 1.6.3
- Yoast SEO 1.7
- Yoast SEO 1.7.1
- Yoast SEO 2.0
- Yoast SEO 2.0.1
- Yoast SEO 2.1
- Yoast SEO 2.1.1
- Yoast SEO 2.2
- Yoast SEO 2.2.1
- Yoast SEO 2.3
- Yoast SEO 2.3.1
- Yoast SEO 2.3.2
- Yoast SEO 2.3.3
- Yoast SEO 2.3.4
- Yoast SEO 2.3.5
- Yoast SEO 3.0
- Yoast SEO 3.0.1
- Yoast SEO 3.0.2
- Yoast SEO 3.0.3
- Yoast SEO 3.0.4
- Yoast SEO 3.0.5
- Yoast SEO 3.0.6
- Yoast SEO 3.0.7
- Yoast SEO 3.1
- Yoast SEO 3.1.1
- Yoast SEO 3.1.2
- Yoast SEO 3.2
- Yoast SEO 3.2.1
- Yoast SEO 3.2.2
- Yoast SEO 3.2.3
- Yoast SEO 3.2.4
- Yoast SEO 3.2.5
- Yoast SEO 3.3.0
- Yoast SEO 3.3.1
- Yoast SEO 3.3.2
- Yoast SEO 3.3.3
- Yoast SEO 3.3.4
- Yoast SEO 3.4
- Yoast SEO 3.4.1
- Yoast SEO 3.4.2
- Yoast SEO 3.5
- Yoast SEO 3.6
- Yoast SEO 3.6.1
- Yoast SEO 3.7.0
- Yoast SEO 3.7.1
- Yoast SEO 3.8
- Yoast SEO 3.9
- Yoast SEO 4.0
- Yoast SEO 4.0.2
- Yoast SEO 4.1
- Yoast SEO 4.2
- Yoast SEO 4.2.1
- Yoast SEO 4.3
- Yoast SEO 4.4
- Yoast SEO 4.5
- Yoast SEO 4.6
- Yoast SEO 4.7
- Yoast SEO 4.7.1
- Yoast SEO 4.8
- Yoast SEO 4.9
- Yoast SEO 5.0
- Yoast SEO 5.0.1
- Yoast SEO 5.0.2
- Yoast SEO 5.1
- Yoast SEO 5.2
- Yoast SEO 5.3
- Yoast SEO 5.3.1
- Yoast SEO 5.3.2
- Yoast SEO 5.3.3
- Yoast SEO 5.4.0
- Yoast SEO 5.4.1
- Yoast SEO 5.4.2
- Yoast SEO 5.5
- Yoast SEO 5.5.1
- Yoast SEO 5.6
- Yoast SEO 5.6.1
- Yoast SEO 5.7
- Yoast SEO 5.7.1
- Yoast SEO 5.8
- Yoast SEO 5.9
- Yoast SEO 5.9.1
- Yoast SEO 5.9.2
- Yoast SEO 5.9.3
- Yoast SEO 6.0
- Yoast SEO 6.1
- Yoast SEO 6.1.1
- Yoast SEO 6.2
- Yoast SEO 6.3
- Yoast SEO 6.3.1
- Yoast SEO 7.0
- Yoast SEO 7.0.1
- Yoast SEO 7.0.2
- Yoast SEO 7.0.3
- Yoast SEO 7.1
- Yoast SEO 7.2
- Yoast SEO 7.3
- Yoast SEO 7.4
- Yoast SEO 7.4.1
- Yoast SEO 7.4.2
- Yoast SEO 7.5
- Yoast SEO 7.5.1
- Yoast SEO 7.5.3
- Yoast SEO 7.6
- Yoast SEO 7.6.1
- Yoast SEO 7.7
- Yoast SEO 7.7.1
- Yoast SEO 7.7.2
- Yoast SEO 7.7.3
- Yoast SEO 7.8
- Yoast SEO 7.9
- Yoast SEO 7.9.1
- Yoast SEO 8.0
- Yoast SEO 8.1
- Yoast SEO 8.1.1
- Yoast SEO 8.1.2
- Yoast SEO 8.2
- Yoast SEO 8.2.1
- Yoast SEO 8.3
- Yoast SEO 8.4
- Yoast SEO 9.0
- Yoast SEO 9.0.1
- Yoast SEO 9.0.2
- Yoast SEO 9.0.3
- Yoast SEO 9.1