Now officially on WordPress.org

CVE Database / CVE-2021-25118

CVE · Medium

CVE-2021-25118 — Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 17.3

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2021-25118 Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 17.3 Exposure of Sensitive Information to an Unauthorized Actor Medium 5.3 < 17.3 17.3 2021-10-05 —

CVE-2021-25118

The Yoast SEO plugin through version 17.2 exposes sensitive information through the WordPress REST API's post endpoints, leaking complete file paths for featured images on posts. Unauthenticated users can retrieve this data without restriction, gaining access to full server path details that could facilitate attacks exploiting other vulnerabilities. The issue was resolved in version 17.3.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings