SQL Injection Vulnerability in SEO Booster Plugin for WordPress

CVE-2026-15445

What is CVE-2026-15445?

The SEO Booster plugin for WordPress is susceptible to time-based SQL Injection through the 'orderby' parameter in versions 7.3.1 and earlier. This vulnerability arises from inadequate escaping of user-supplied parameters and insufficient handling of SQL queries. Authenticated users with administrator-level permissions can exploit this flaw to insert additional SQL queries, potentially leading to the extraction of sensitive database information. Although certain security functions like esc_sql() and sanitize_text_field() are employed, they do not effectively neutralize critical SQL syntax elements in the unquoted ORDER BY context, allowing malicious manipulation of the query.

References