Is CVE-2025-14481 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-14481 being exploited in the wild.

How severe is CVE-2025-14481?

Medium severity, with a CVSS score of 4.3, published 27 May 2026.

Which products and versions are affected?

Yoast SEO up to, and including, 26.5.

Is there a fix for CVE-2025-14481?

A patch was published on 2025-12-05: Fix merged into release/26.6 branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-14481 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-14481?

Check whether you run Yoast SEO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-14481: Yoast SEO IDOR in Meta Search REST API endpoint

CVE-2025-14481 · Severity: medium · CVSS 4.3 · Published 2026-05-27

Yoast SEO is a popular WordPress plugin used to optimize websites for search engines. A security flaw in the plugin allows logged-in users with low-level permissions (such as contributors) to view sensitive SEO metadata for any post on the site. This includes access to information from private posts, drafts, and content owned by other users that should normally be restricted.

Vendors: Yoast.

Quick answers

Is CVE-2025-14481 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-14481 being exploited in the wild.
How severe is CVE-2025-14481?: Medium severity, with a CVSS score of 4.3, published 27 May 2026.
Which products and versions are affected?: Yoast SEO up to, and including, 26.5.
Is there a fix for CVE-2025-14481?: A patch was published on 2025-12-05: Fix merged into release/26.6 branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-14481 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-14481?: Check whether you run Yoast SEO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Yoast SEO plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) due to insufficient authorization checks in the Meta Search REST API endpoint. Specifically, the 'meta-search-route.php' component fails to verify post ownership or appropriate permissions when processing the 'post_id' parameter. An authenticated attacker with at least Contributor-level access can exploit this by sending crafted REST API requests to retrieve sensitive SEO metadata. This metadata can include information from posts the user does not own, as well as private and draft posts. The issue is addressed in version 26.6 by improving the capability checks within the route handler.

Affected products

Yoast Yoast SEO up to, and including, 26.5

Timeline

2025-12-05: patched: Fix merged into release/26.6 branch
2026-05-27: disclosed: CVE published by Wordfence/NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.