Yoast SEO Premium: update to 27.6.1 to fix a flaw

If your WordPress site uses Yoast SEO Premium older than version 27.6.1, update it. In older versions, any logged-in user who can write posts, such as an author, could add their own commands to the site's server settings file (htaccess). Yoast fixed this in version 27.6.1 in May 2026, and the details were made public on 26 October 2026.

What the flaw is

The htaccess file in your website's main folder tells the web server how to handle your site: redirects, security rules and more. Yoast SEO Premium can write redirects into that file. In versions before 27.6.1, a logged-in user with the right to edit posts could misuse this to put any server directive into the file. Yoast says this only applied when file-based redirects were switched on.

Patchstack, which published the details, rates it medium and says it can lead to running code on the site. The attacker needs an account on your site first, at author level or higher. Sites where only the owner logs in are at lower risk; sites with several writers, guest authors or old staff accounts are at higher risk.

The free Yoast SEO plugin is not part of this report. It is about Yoast SEO Premium.

What to do

1. Log in to WordPress and open Plugins > Installed Plugins.
2. Find Yoast SEO Premium and check the version. If it is below 27.6.1, take a backup and update it. Premium updates need an active Yoast licence.
3. Update the free Yoast SEO plugin at the same time, because Premium needs a matching version.
4. Open Users and remove accounts that no longer need access, especially old staff and guest authors.
5. If your licence has expired and you cannot update, consider switching to the free Yoast SEO plugin, which gets updates without a licence.

If a web designer looks after your site, send them this page. Our monthly website care includes plugin updates like this one.

Source and credit

We are sharing this news from Yoast and Patchstack. This summary is written by Synctech in our own words.

• Yoast SEO Premium changelog, version 27.6.1, Yoast, 26 May 2026: https://yoast.com/wordpress/plugins/seo-premium/change-log/
• WordPress Yoast SEO Premium Plugin < 27.6.1 is vulnerable to Remote Code Execution (RCE), Patchstack, 26 October 2026: https://patchstack.com/database/wordpress/plugin/wordpress-seo-premium/vulnerability/wordpress-yoast-seo-premium-plugin-27-6-1-author-arbitrary-htaccess-directive-injection-to-rce-vulnerability

Retrieved 27 October 2026. Yoast, WordPress and Patchstack are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.