← Back to CVE List
CVE-2026-15660NVD
Vulnerability Summary
The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handle_oauth_callback() function which is hooked to admin_init and processes $_GET['access_token'] and $_GET['google_email'] without verifying the caller's role. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the seobooster_access_token, seobooster_google_email, and seobooster_gsc_sites options and delete the seobooster_needs_reauth flag by visiting a crafted /wp-admin/ URL, disrupting the Google Search Console integration and injecting attacker-chosen data into site options via the attacker-supplied token that drives an outbound Google API request whose response is stored.
CVSS v3.1 Base Metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityNone
IntegrityLow
AvailabilityNone
External References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3fd58af7-e8ef-4518-bed8-4e20c8e61db7?source=cve
- https://plugins.trac.wordpress.org/browser/seo-booster/tags/7.3.2/seo-booster.php#L546
- https://plugins.trac.wordpress.org/browser/seo-booster/tags/7.3.2/seo-booster.php#L243
- https://plugins.trac.wordpress.org/browser/seo-booster/tags/7.3.2/seo-booster.php#L547
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3665611%40seo-booster&new=3665611%40seo-booster