CVE-2026-15425

The CVSS 6.4 score assigned to this vulnerability significantly understates the real-world risk. The core issue lies in how Yoast SEO handles the post slug when generating the canonical URL: it passes data through WordPress's get_permalink() function, which performs percent-encoding, but browsers auto-decode certain sequences during URL rendering. This creates an exploitable gap between what the server encodes and what the browser interprets — a pattern documented in WordPress security circles since at least 2017. The privilege requirement deserves scrutiny. Yoast SEO powers over 10 million sites, the vast majority of which are content-heavy editorial platforms running multi-author environments. Author-level access is the baseline operational role on these sites, not a hardened privilege threshold. Compromised author credentials, disgruntled employees, or credential stuffing attacks are realistic threat vectors, not edge cases. Once an author account is compromised, the attacker gets one hop to stored XSS affecting every page on the site. The technical dependency on pretty permalinks is not a meaningful mitigation — this is the standard WordPress deployment configuration and the default recommendation for SEO-focused sites. Running without pretty permalinks while using an SEO plugin is an edge case that doesn't reflect production reality. Actionable steps: Audit author accounts on sites running Yoast SEO and deactivate any unused, expired, or orphaned profiles. Enforce 2FA on all contributor accounts. Review user role assignments and downgrade accounts that don't need posting capabilities. The patch addresses the encoding issue at the plugin level, but the deeper architectural problem — WordPress APIs treating URL generation as a utility function rather than a security boundary — remains unaddressed ecosystem-wide.

Reviewed through automated stages and approved by a human before publication.