AA-Team Premium SEO Pack <= 1.8.0 — Local File Disclosure and Arbitrary File Upload

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Premium Seo Pack – Light Version.
• No admin access? Run a passive check of your site. It reads public files only.
• No account is needed to exploit this. Treat any exposed site on an affected version as at risk.

What to do

1. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch Premium Seo Pack – Light Version to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Evex.

The AA-Team Premium SEO Pack plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 1.8.0 via the 'file_content' parameter. This makes it possible for unauthenticated attackers that include the default connection key to upload arbitrary files like shell scripts that can be used to execute code on the server. The plugin is also vulnerable to Local File Disclosure via the 'file' parameter. This makes it possible for unauthenticated attackers who include the default connection key to read the contents of arbitrary files on the server, which can contain sensitive information.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Timeline

1. May 1, 2015

   CVE published

   Severity critical, CVSS 9.8

2. Nov 13, 2026

   Record last updated