Remote Code Execution via settings ZIP import in Yoast SEO

The Yoast SEO settings import extracted every file from an uploaded ZIP archive into a web-accessible uploads folder and only removed it afterwards. A user with the SEO Manager role could put a PHP file in the archive and run it on the server during that window. The patch stops extracting the archive to disk and imports the settings text directly.... Weiterlesen: Remote Code Execution via settings ZIP import in Yoast SEO