CVE-2026-15660

Received Received - Intake

Missing Authorization in SEO Booster WordPress Plugin

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handle_oauth_callback() function which is hooked to admin_init and processes $_GET['access_token'] and $_GET['google_email'] without verifying the caller's role. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the seobooster_access_token, seobooster_google_email, and seobooster_gsc_sites options and delete the seobooster_needs_reauth flag by visiting a crafted /wp-admin/ URL, disrupting the Google Search Console integration and injecting attacker-chosen data into site options via the attacker-supplied token that drives an outbound Google API request whose response is stored.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-15660

Affected Vendors & Products

Vendor	Product	Version / Range
seobooster	seo_booster	to 7.4.7 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

The SEO Booster WordPress plugin up to version 7.4.7 has a missing authorization vulnerability. The handle_oauth_callback() function, hooked to admin_init, processes user-supplied GET parameters without checking user roles. This allows authenticated attackers with Subscriber-level access or higher to manipulate plugin settings by visiting a specially crafted URL.

Detection Guidance

Check for unauthorized modifications to WordPress site options by inspecting the seobooster_access_token, seobooster_google_email, and seobooster_gsc_sites values in the database. Look for suspicious admin_init hooks or unexpected GET requests to /wp-admin/ with access_token or google_email parameters.

Impact Analysis

An attacker could overwrite critical plugin options like access tokens and email addresses, disrupt Google Search Console integration, and inject malicious data into site settings. This could lead to unauthorized changes in SEO configurations or expose sensitive site data through manipulated API requests.

Mitigation Strategies

Update the SEO Booster plugin to the latest version beyond 7.4.7. If an update is unavailable, disable the plugin immediately. Review site options for unauthorized changes and revoke any suspicious Google API tokens.

Hi! I’m here to help you understand CVE-2026-15660. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70