---
id: CVE-2026-15660
title: >-
  The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in
  versions up to, and including, 7.4.7
summary: >-
  The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in
  versions up to, and including, 7.4.7. This is due to a missing capability
  check on the handle_oauth_callback() function which is hooked to admin_init
  and proc…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-862
vendor: cleverplugins
product: SEO Booster
affected:
  - seo_booster <= 7.4.7
published: '2026-09-19'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T13:33:33.387'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-15660'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/seo-booster/tags/7.3.2/seo-booster.php#L243
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/seo-booster/tags/7.3.2/seo-booster.php#L546
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/seo-booster/tags/7.3.2/seo-booster.php#L547
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&old=3665611%40seo-booster&new=3665611%40seo-booster
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/3fd58af7-e8ef-4518-bed8-4e20c8e61db7?source=cve
    label: security@wordfence.com
tags:
  - nvd
  - cve.org
epss: 0.00196
epssPercentile: 0.0824
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-19T13:22:14.156576Z'
ingestedAt: '2026-09-19T02:56:32.979Z'
---

## Overview

The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handle_oauth_callback() function which is hooked to admin_init and processes $_GET['access_token'] and $_GET['google_email'] without verifying the caller's role. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the seobooster_access_token, seobooster_google_email, and seobooster_gsc_sites options and delete the seobooster_needs_reauth flag by visiting a crafted /wp-admin/ URL, disrupting the Google Search Console integration and injecting attacker-chosen data into site options via the attacker-supplied token that drives an outbound Google API request whose response is stored.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.