CVE-2021-25118

Yoast SEO 16.7-17.2 - Unauthenticated Full Path Disclosure

State: Published
Severity: Not scored
Published: Feb 28, 2022
Updated: Aug 3, 2024
Reserved: Jan 14, 2021

Description

The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints which could help an attacker identify other vulnerabilities or help during the exploitation of other identified vulnerabilities.

Scores

The record has no CVSS score.

Weaknesses

CWE-200 Information Exposure

Affected Products

Product	Versions
Yoast SEOUnknown	16.7 to before 16.7*Affected 17.3 to before 17.3Affected

References

https://wpscan.com/vulnerability/2c3f9038-632d-40ef-a099-6ea202efb550
https://plugins.trac.wordpress.org/changeset/2608691

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.