CVE-2021-25118

    Dashboard / Vulnerabilities / CVE-2021-25118

    CVE-2021-25118

    Published: 28 Feb 2022Last Modified: 24 Oct 2026

    Summary:

    Details: The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints which could help an attacker identify other vulnerabilities or help during the exploitation of other identified vulnerabilities.

    References: https://plugins.trac.wordpress.org/changeset/2608691, https://wpscan.com/vulnerability/2c3f9038-632d-40ef-a099-6ea202efb550

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- cc6a50cb82e261fed9edd961e9937a96fb0c1f0c
    Fixed -71353e912a3ed264ff39e0bc3929bac8d8a31edc

    Affected versions

    17.2.1
    17.2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-25118 | CVE-DB