PT-2022-9672 · Yoast · Yoast Seo

Fariq Fadillah Gusti Insani · Published 2022-02-28 · Updated 2022-10-27 · CVE-2021-25118

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Yoast SEO WordPress plugin versions 16.7 through 17.2

Description The issue discloses the full internal path of featured images in posts via the "wp/v2/posts" REST endpoints, which could help an attacker identify other vulnerabilities or assist in the exploitation of other identified vulnerabilities.

Recommendations For versions 16.7 through 17.2, update to version 17.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the "wp/v2/posts" endpoint until the update is applied.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-25118

Affected Products

Yoast Seo

References · 5

• 🔥 https://wpscan.com/vulnerability/2c3f9038-632d-40ef-a099-6ea202efb550 · Exploit
• https://osv.dev/vulnerability/CVE-2021-25118 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25118 · Security Note
• https://t.me/cvenotify/27454 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/2608691 · Note