LiveActive security incident?Get immediate response
CVE Record

CVE-2018-19370: A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wo...

A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordPress allows an SEO Manager to perform command execution on the Operating System via a ZIP import.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2018-19370 affects the Yoast SEO WordPress plugin before 9.2.0. A user with SEO Manager privileges could abuse a ZIP import race condition to execute operating system commands. This is serious where WordPress admin roles are broadly assigned, but the provided sources do not show active exploitation.

Executive priority

Prioritize remediation for any business-critical WordPress site using Yoast SEO before 9.2.0, especially if multiple users have SEO Manager access. Treat this as high urgency because the reported impact is command execution, even though exploitation evidence is not supplied.

Technical view

The issue is a race condition in unzip_file within admin/import/class-import-settings.php in Yoast SEO wordpress-seo before 9.2.0. The reported impact is OS command execution via ZIP import by an SEO Manager. The bundle lacks CVSS, CWE, CPE, and detailed affected-version metadata beyond “before 9.2.0.”

Likely exposure

Exposure is likely limited to WordPress sites running Yoast SEO versions before 9.2.0 where an account has SEO Manager access. Internet exposure depends on the WordPress admin surface and account compromise risk, not anonymous access per the provided description.

Exploitation context

CISA KEV is false, and the supplied sources do not confirm active exploitation. Public references include a video, the WordPress plugin developer page, and a Yoast commit, but the bundle does not provide reliable exploitation prevalence or attack telemetry.

Researcher notes

The strongest source detail is the CVE description: authenticated SEO Manager, ZIP import, race condition, OS command execution, fixed boundary before 9.2.0. Missing CVSS, CWE, CPE, and KEV evidence reduce precision. Avoid assuming anonymous exploitation or broader affected products.

Mitigation direction

  • Upgrade Yoast SEO wordpress-seo from versions before 9.2.0 to a supported current release.
  • Review vendor guidance and changelog notes before applying updates in production.
  • Limit SEO Manager privileges to trusted users with a business need.
  • Remove stale WordPress accounts and enforce strong authentication for admin roles.

Validation and detection

  • Inventory WordPress sites and record installed Yoast SEO wordpress-seo versions.
  • Confirm no site is running Yoast SEO earlier than 9.2.0.
  • Review which users hold SEO Manager or higher WordPress privileges.
  • Check administrative activity for unexpected ZIP imports during the exposure window.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2018-19370 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.