CVE-2023-28775 MEDIUM

CVE-2023-28775: WordPress Yoast SEO Premium plugin <= 20.4 - Unauthenticated Zapier API Key Reset vulnerability

Vendor Yoast

Product Yoast SEO Premium

Weakness CWE-862 · Missing authorization

Published June 11, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

Missing Authorization vulnerability in Yoast Yoast SEO Premium.This issue affects Yoast SEO Premium: from n/a through 20.4.

Explanation of Vulnerability in Simple Terms

02Summary

Yoast SEO Premium versions up to 20.4 lack proper authorization checks, allowing unauthenticated attackers to trigger a denial-of-service condition. The vulnerability does not require user interaction or special network conditions. Site availability may be temporarily impacted if the affected endpoint is repeatedly targeted.

What an attacker can do

03Attacker Capabilities

Make the site temporarily unavailable by sending repeated requests to an unprotected endpoint.

Potential impact on your site

04Site Impact

Your site may become slow or unresponsive if this endpoint is targeted with automated requests.

Conditions required to exploit

05Prerequisites

Network access to the site; no authentication or user interaction required.

Key dates

06Disclosure timeline

June 11, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-28775 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html AskarLabs — CWE-862 write-up Missing Authorization

Related vulnerabilities