Executive brief
Yoast SEO is a popular WordPress plugin used to optimize websites for search engines. A security flaw in the plugin allows logged-in users with low-level permissions (such as contributors) to view sensitive SEO metadata for any post on the site. This includes access to information from private posts, drafts, and content owned by other users that should normally be restricted.
Technical details
The Yoast SEO plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) due to insufficient authorization checks in the Meta Search REST API endpoint. Specifically, the 'meta-search-route.php' component fails to verify post ownership or appropriate permissions when processing the 'post_id' parameter. An authenticated attacker with at least Contributor-level access can exploit this by sending crafted REST API requests to retrieve sensitive SEO metadata. This metadata can include information from posts the user does not own, as well as private and draft posts. The issue is addressed in version 26.6 by improving the capability checks within the route handler.
Affected products
- Yoast Yoast SEO up to, and including, 26.5
Timeline
- 2025-12-05: patched: Fix merged into release/26.6 branch
- 2026-05-27: disclosed: CVE published by Wordfence/NVD
References
- https://github.com/Yoast/wordpress-seo/pull/22797
- https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/26.4/src/routes/meta-search-route.php
- https://plugins.trac.wordpress.org/browser/wordpress-seo/trunk/src/routes/meta-search-route.php
- https://plugins.trac.wordpress.org/changeset/3412286/wordpress-seo
- https://www.wordfence.com/threat-intel/vulnerabilities/id/04b2123d-ae0c-4984-95f5-7040f8604c92?source=cve