UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2021-25118

Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Exposure of Sensitive Information to an Unauthorized Actor

Severity
Medium 5.3
Published
5 Oct 2021
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
17.3
Also known as
WPV-c9f67e5eadc4
Sources
NVD, WPVulnerability

Description

The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints which could help an attacker identify other vulnerabilities or help during the exploitation of other identified vulnerabilities.

Affected software

SoftwareAffected versions
Yoast SEOServers and applications · cpe:a:yoast:yoast_seo
  • From 16.7 before 17.3
Yoast SEOWordPress plugins · wp-plugin:wordpress-seo
  • Every version before 17.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-25118
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-25118
  • Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wordpress-seo/yoast-seo-172-full-path-disclosure