Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-25118

Yoast SEO 16.7-17.2 - Unauthenticated Full Path Disclosure

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints which could help an attacker identify other vulnerabilities or help during the exploitation of other identified vulnerabilities.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Yoast SEO

  • 16.7 to < 16.7*affected
  • 17.3 to < 17.3affected

References