CVE-2026-15660

Overview

The SEO Booster plugin for WordPress versions up to 7.4.7 suffers from a missing authorization check that allows any authenticated user with Subscriber role or higher to overwrite critical options. This can disrupt the Google Search Console integration and inject attacker‑supplied data into site options. The flaw is exploitable via a crafted /wp-admin/ URL that triggers the vulnerable handle_oauth_callback function.

Description

The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handle_oauth_callback() function which is hooked to admin_init and processes $_GET['access_token'] and $_GET['google_email'] without verifying the caller's role. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the seobooster_access_token, seobooster_google_email, and seobooster_gsc_sites options and delete the seobooster_needs_reauth flag by visiting a crafted /wp-admin/ URL, disrupting the Google Search Console integration and injecting attacker-chosen data into site options via the attacker-supplied token that drives an outbound Google API request whose response is stored.

Impact

Confidentiality: attacker can inject arbitrary Google API tokens and view or modify sensitive options. Integrity: the plugin’s options are overwritten, potentially altering site behavior. Availability: the Google Search Console integration can be disabled, impacting SEO monitoring. Site administrators, WordPress site owners, and SEO teams are directly affected.

Remediation

Update the SEO Booster plugin to version 7.4.8 or later. If an update is not immediately possible, remove or disable the handle_oauth_callback hook for non‑administrator roles, or restrict access to /wp-admin/ for Subscriber users. After patching, reset the seobooster_* options and delete the seobooster_needs_reauth flag, then verify that Google Search Console integration functions correctly. Monitor admin logs for unauthorized access attempts.

Risk context

The CVSS v3 score of 4.3 and EPSS of 0.00196 indicate a medium‑severity vulnerability with low predicted exploitation probability. However, any WordPress site using the affected SEO Booster plugin should prioritize patching to prevent potential data manipulation and service disruption.

Affected products

• WordPress SEO Booster <=7.4.7