Name: CVE-2021-25118: Exposure of Sensitive Information to an Unauthorized Actor
Creator: Rapid7
Published: 2022-02-28T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2021-25118, CWE-200, CVSS 5.3, EPSS 0.05632

The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints which could help an attacker identify other vulnerabilities or help during the exploitation of other identified vulnerabilities.

CVSS Details

CVSS 3.1 Base Score: 5.3
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Wordpress Seo Plugin	—	Update wordpress-seo plugin to version 17.3, or a newer patched version	May 15, 2025	Oct 5, 2021

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence