Yoast SEO EUVD-2025-209950

Exploitation requires a valid WordPress account with at minimum Contributor-level access, confirmed by PR:L in the CVSS vector. The Meta Search REST API endpoint is enabled by default when the Yoast SEO plugin is active; no non-default configuration is required. Exploitation is bounded by the authentication prerequisite - unauthenticated users cannot exploit this vulnerability - and the impact is strictly read-only disclosure of SEO metadata (no write, delete, or privilege escalation capability). Sites with no externally issued Contributor or higher accounts (e.g., single-author or closed-registration installations) face no practical risk. The disclosure scope is limited to SEO metadata fields rather than full post content, body text, or media.

CVSS 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N indicates network-accessible, low-complexity exploitation requiring Contributor-level authentication, with a limited confidentiality impact and no integrity or availability impact. EPSS at 0.03% (8th percentile) reflects very low real-world exploitation probability, and the vulnerability is absent from CISA KEV. No public exploit code has been identified. The practical risk is highest for multi-author WordPress sites where Contributor accounts are broadly issued and where unpublished content (embargoed campaigns, draft articles, private pages) carries meaningful sensitivity in its SEO metadata. Single-author sites or installations where no external Contributor accounts exist are not practically exposed. The authentication prerequisite meaningfully limits blast radius compared to unauthenticated IDOR vulnerabilities; this is a data disclosure issue, not a code execution or privilege escalation path.

An attacker who holds or registers a Contributor-level WordPress account sends authenticated GET requests to the Yoast SEO Meta Search REST API endpoint, iterating post_id values. Because the permission check validates only the generic edit_posts capability rather than per-object ownership, the API returns SEO metadata - titles, descriptions, and focus keywords - for any post ID, including private or draft posts not yet published. No public exploit code has been identified, but the technique requires only standard HTTP requests and knowledge of the endpoint path.