WordPress Plugin Vulnerabilities
Yoast SEO < 26.6 - Contributor+ IDOR to Sensitive Information Exposure via post_id Parameter
Description
The plugin does not verify post ownership in its Meta Search REST API endpoint, allowing authenticated attackers with Contributor-level access and above to read SEO metadata from any post on the site via the `post_id` parameter, including posts owned by other users, private posts, and draft posts.
Affects Plugins
Fixed in 26.6 References
Classification
Type
IDOR
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
NumeX
Verified
No
WPVDB ID
Timeline
Publicly Published
2026-05-26 (about 4 months ago)
Added
2026-05-26 (about 4 months ago)
Last Updated
2026-05-26 (about 4 months ago)
