Yoast SEO <= 3.2.4 - Sensitive Data Exposure
2016-05-06 00:00
Panagiotis VagenasStrategic Overview
StatusPatched in 3.2.5
Affected Version
<= 3.2.4CVSS5.3Medium
CVE
N/AVulnerability Overview
The Yoast SEO plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including 3.2.4. This is due to privileged AJAX actions being executable by regular users. This makes it possible for registered attackers to extract sensitive data including Yoast SEO settings and post metadata relative to focus and term keywords.
Technical Analysis
REMEDIATION: Update to version 3.2.5, or a newer patched version --- IDENTIFIER: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C