What the vulnerability does
01Description
The Yoast SEO plugin for WordPress is vulnerable to Insecure Direct Object References in all versions up to, and including, 26.5. This is due to insufficient authorization checks in the Meta Search REST API endpoint that fail to verify post ownership. This makes it possible for authenticated attackers, with Contributor-level access and above, to read sensitive SEO metadata from any post on the site via the 'post_id' parameter, including posts owned by other users, private posts, and draft posts.
Explanation of Vulnerability in Simple Terms
02Summary
Yoast SEO versions up to 26.5 contain an authorization flaw that allows authenticated users to access sensitive information they should not be able to view. An attacker with a low-privilege account can read data that is restricted to higher-privilege users. The vulnerability requires an active user account but no additional user interaction. Update to a version newer than 26.5.
What an attacker can do
03Attacker Capabilities
Read sensitive data restricted to higher-privilege users via an authenticated account.
Potential impact on your site
04Site Impact
Unauthorized users can view restricted information in Yoast SEO, potentially exposing SEO strategy or configuration details.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site; no user interaction required.
Key dates
06Disclosure timeline
May 27, 2026
CVE published
May 27, 2026
Record updated
