Missing Authorization Vulnerability in SEO Booster Plugin for WordPress

CVE-2026-15660

What is CVE-2026-15660?

The SEO Booster plugin for WordPress contains a vulnerability linked to a missing capability check in the handle_oauth_callback() function. This issue affects versions up to and including 7.4.7. Because of the absent authorization checks, authenticated users with Subscriber-level access or higher can manipulate settings related to the Google Search Console integration. They can overwrite critical options such as seobooster_access_token and seobooster_google_email by visiting a specially crafted admin URL. This flaw permits attackers to inject arbitrary data into site options through the authorized token within an outbound Google API request, severely compromising the integration's functionality.

References