External risk intelligence

Premium SEO WordPress Plugin Backdoor Allows Full Site Takeover

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-14812

The vulnerability affects a WordPress plugin, which is typically deployed as part of a public-facing web application. WordPress sites are frequently exposed to the public internet, making the plugin's functionality and its associated attack surface readily reachable by external actors in common deployments.

Remote Code Execution

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Premium SEO WordPress plugin, which could allow unauthenticated attackers to gain complete control of affected websites. This backdoor mechanism can create hidden administrator accounts and potentially enable remote code execution, data manipulation, and script injection, posing a significant risk to site integrity and operations.

A plugin backdoor gives attackers full site control.
Unauthenticated access bypasses all security.
Confirm if this plugin is in use.

Attack Path

How an attacker could exploit the issue

An attacker can gain full control of a WordPress site by exploiting a backdoor hidden within the Premium SEO plugin. This backdoor allows an unauthenticated attacker to create a secret administrator account, and in some cases, also execute code remotely, perform server-side requests, or inject content into the website's front-end. This comprehensive access can lead to a complete compromise of the affected site.

No authentication needed to access.
Backdoor in plugin creates admin account.
Full site control and code execution.

Live Threat

Current exploitation, exposure, and threat context

A malicious backdoor in the Premium SEO WordPress plugin could grant unauthenticated attackers full control of a website. This backdoor may create a hidden administrator account and, in certain builds, enable remote code execution, server-side request forgery, and arbitrary content injection, allowing attackers to compromise the entire site.

Website administrator accounts and content.
Unauthenticated remote code execution and content injection.
Complete website takeover and compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Premium SEO WordPress plugin grants unauthenticated attackers full control of affected sites through a hidden administrator account and potential remote code execution. Identifying all instances of this plugin, confirming their reachability and business criticality, and assigning an accountable owner are the crucial first steps. Remediation planning should then be prioritized based on the identified risks and operational impact.

Website owners, platform teams, and security teams.
Confirm plugin presence and public reachability.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Premium SEO WordPress plugin?

Premium SEO is a software add-on for the WordPress content management system designed to help site owners optimize their web pages for search engines. It integrates directly into the WordPress dashboard, extending the core platform's functionality to manage site metadata, keywords, and search visibility features.

What does this CVE-2026-14812 vulnerability actually do?

This vulnerability involves a malicious backdoor embedded within the plugin's code. It represents a severe weakness where the software is intentionally designed to bypass security controls, allowing unauthorized parties to create administrative accounts, run arbitrary code on the server, and modify website content without needing to log in.

How does an attacker trigger this backdoor?

The backdoor is triggered by sending specially crafted, unauthenticated network requests directly to the affected WordPress site. An attacker does not need to guess a password or exploit a complex login process; the malicious functionality is accessible to anyone with network access to the site. Simply visiting the site as a regular user does not trigger the backdoor.

Why is this plugin dangerous for my web presence?

Halo Surface Signal indicates that because this is a WordPress plugin, it is commonly part of a public-facing web application. Since these sites are typically reachable from the public internet, the backdoor creates an accessible entry point for external actors to take full control of your web server and data.

What should I do if I am running this plugin?

Your first step is to confirm whether the Premium SEO plugin is installed on any of your websites. If found, prioritize identifying the business impact of that site and consult with your technical or security team to plan for the immediate removal of the plugin, as it is inherently malicious.

References

wpscan.com/vulnerability/0115a640-7139-4ef9-81be-6ee5c755a601/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.