CVE-2026-15660 in SEO Booster Plugin
Summary
by MITRE • 09/19/2026
The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handle_oauth_callback() function which is hooked to admin_init and processes $_GET['access_token'] and $_GET['google_email'] without verifying the caller's role. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the seobooster_access_token, seobooster_google_email, and seobooster_gsc_sites options and delete the seobooster_needs_reauth flag by visiting a crafted /wp-admin/ URL, disrupting the Google Search Console integration and injecting attacker-chosen data into site options via the attacker-supplied token that drives an outbound Google API request whose response is stored.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/19/2026
The SEO Booster plugin for WordPress contains a critical missing authorization vulnerability in versions up to 7.4.7, classified under CWE-862 as Missing Authorization. This flaw resides within the handle_oauth_callback function, which is registered to execute during the admin_init hook. The core technical deficiency is the absence of any capability or role verification before processing user-supplied input from the $_GET superglobal array. Specifically, the function accepts access_token and google_email parameters without validating whether the requesting user possesses administrative privileges or other necessary permissions to modify sensitive plugin configuration data. This oversight allows authenticated users with even minimal Subscriber-level access and above to manipulate internal state variables that should be restricted to higher-privileged accounts.
The operational impact of this vulnerability is significant, as it enables an attacker to overwrite critical site options including seobooster_access_token, seobooster_google_email, and seobooster_gsc_sites while simultaneously deleting the seobooster_needs_reauth flag. By visiting a crafted URL containing maliciously constructed query parameters, an authenticated user can effectively hijack the Google Search Console integration associated with the WordPress installation. The attacker-supplied token is subsequently used to drive an outbound request to the Google API, and the response from this external service is stored directly into the site options database. This mechanism allows for data injection where the content of the Google API response determines what gets written to the configuration files, potentially leading to further exploitation depending on how that data is rendered or utilized elsewhere in the application logic.
From a threat modeling perspective, this vulnerability aligns with ATT&CK technique T1078, Valid Accounts, as it requires initial authentication but exploits insufficient access control mechanisms typical of privilege escalation scenarios. The ability to overwrite OAuth tokens and email addresses disrupts legitimate Google Search Console integration, causing denial of service for site owners who rely on these metrics. Furthermore, the injection of attacker-controlled data into persistent storage options poses a risk for subsequent attacks such as stored cross-site scripting if that data is ever reflected in admin interfaces without proper sanitization. The deletion of the re-authentication flag ensures that the compromised state persists until manually corrected by an administrator, extending the window of exposure and complicating incident response efforts.
Mitigation strategies should prioritize immediate patching to version 7.4.8 or later where this capability check has been implemented. In environments where upgrading is not immediately feasible, administrators can implement a temporary workaround by restricting access to the wp-admin directory via IP whitelisting for all users except those with verified administrative roles. Additionally, enabling two-factor authentication for all WordPress accounts reduces the likelihood of credential compromise that would be required to exploit this missing authorization flaw. Security monitoring should also focus on detecting unusual outbound API calls from the server and auditing changes to plugin option tables for unauthorized modifications indicative of exploitation attempts.