The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the a…

The Improve SEO WordPress plugin through version 2.0.11 contains a critical file upload vulnerability. The plugin only validates the content type of uploaded files but fails to restrict the file extension, allowing attackers to upload PHP files with executable extensions. These files are written to a publicly accessible directory, enabling remote code execution. The vulnerability can be exploited by unauthenticated users, making it particularly dangerous. No authentication or elevated privileges are required to exploit this flaw. Successful exploitation grants attackers full control over the affected WordPress installation. The issue stems from insufficient server-side validation of uploaded file extensions.