{"id":"CVE-2026-15660","title":"The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7","summary":"The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handle_oauth_callback() function which is hooked to admin_init and proc…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cwe":["CWE-862"],"vendor":"cleverplugins","product":"SEO Booster","affected":["seo_booster <= 7.4.7"],"published":"2026-09-19","updated":"2026-09-21","sourceUpdated":"2026-09-21T13:33:33.387","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-15660","references":[{"url":"https://plugins.trac.wordpress.org/browser/seo-booster/tags/7.3.2/seo-booster.php#L243","label":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/seo-booster/tags/7.3.2/seo-booster.php#L546","label":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/seo-booster/tags/7.3.2/seo-booster.php#L547","label":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3665611%40seo-booster&new=3665611%40seo-booster","label":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fd58af7-e8ef-4518-bed8-4e20c8e61db7?source=cve","label":"security@wordfence.com"}],"tags":["nvd","cve.org"],"epss":0.00196,"epssPercentile":0.09596,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-19T13:22:14.156576Z"},"ingestedAt":"2026-09-19T02:56:32.979Z","slug":"CVE-2026-15660","body":"## Overview\n\nThe SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handle_oauth_callback() function which is hooked to admin_init and processes $_GET['access_token'] and $_GET['google_email'] without verifying the caller's role. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the seobooster_access_token, seobooster_google_email, and seobooster_gsc_sites options and delete the seobooster_needs_reauth flag by visiting a crafted /wp-admin/ URL, disrupting the Google Search Console integration and injecting attacker-chosen data into site options via the attacker-supplied token that drives an outbound Google API request whose response is stored.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}