CVE-2026-15458: SEO Booster WordPress SQLi Vulnerability

CVE-2026-15458 Overview

CVE-2026-15458 is a SQL Injection vulnerability [CWE-89] affecting the SEO Booster plugin for WordPress in all versions up to and including 7.3.1. The flaw resides in the handling of the sort_field parameter, which is passed into a database query without sufficient escaping or query preparation. Authenticated attackers holding administrator-level access or higher can append arbitrary SQL to the existing query and extract sensitive data from the WordPress database. The issue was assigned a CVSS score of 4.9 and was published on July 16, 2026.

Critical Impact
Authenticated administrators can execute arbitrary SQL against the WordPress database, enabling extraction of user credentials, session tokens, and other confidential records stored in wp_users, wp_usermeta, and custom tables.

Affected Products

WordPress SEO Booster plugin versions up to and including 7.3.1
WordPress installations using the vulnerable seo-booster.php handler
Sites where non-super-admin accounts hold administrator privileges (multi-admin environments)

Discovery Timeline

2026-07-16 - CVE-2026-15458 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-15458

Vulnerability Analysis

The vulnerability is a classic in-band SQL Injection in the SEO Booster plugin. The plugin accepts a sort_field request parameter and concatenates the raw value into an SQL statement executed against the WordPress database. Because the plugin neither escapes the input with esc_sql() nor uses $wpdb->prepare() with proper placeholders, attacker-supplied SQL syntax is interpreted by the MySQL server.

Exploitation requires an authenticated session at administrator level or above, which limits opportunistic abuse but does not eliminate risk. Compromised admin credentials, malicious insiders, and privilege escalation chains from lower-privileged flaws can all supply the required authentication context. Successful exploitation exposes database contents, including password hashes and secret keys, which can be leveraged to escalate to full site takeover.

Affected source locations include lines 389, 404, and 406 of seo-booster.php in the 7.3.1 tag, according to the WordPress SEO Booster Code Review.

Root Cause

The root cause is insufficient input validation combined with unsafe query construction. The sort_field parameter is intended to select a column for an ORDER BY clause, a context where $wpdb->prepare() placeholders cannot be used directly. Safe implementations must validate the value against an allowlist of known column names before interpolation. The vulnerable code performs no such allowlist check and interpolates the parameter into the SQL string directly.

Attack Vector

An authenticated administrator issues an HTTP request to the plugin endpoint that consumes sort_field. The attacker replaces the expected column name with an SQL fragment such as a UNION SELECT payload targeting wp_users or a time-based blind injection payload. The database server executes the appended query and returns results either inline or through inferred timing.

Refer to the Wordfence Vulnerability Analysis for full technical details. No verified public exploit code is available at this time.

Detection Methods for CVE-2026-15458

Indicators of Compromise

HTTP requests to SEO Booster endpoints containing SQL keywords such as UNION, SELECT, SLEEP(, or INFORMATION_SCHEMA inside the sort_field parameter.
Unexpected SELECT statements against wp_users or wp_usermeta originating from the plugin's execution context in MySQL general or slow query logs.
Administrator account activity from unfamiliar IP addresses immediately preceding anomalous query patterns.

Detection Strategies

Enable MySQL general query logging and alert on queries containing ORDER BY clauses with SQL metacharacters such as parentheses, commas, or subquery keywords in the sort column position.
Deploy WordPress-aware Web Application Firewall (WAF) rules that inspect requests to seo-booster.php and block payloads matching SQL injection signatures on the sort_field parameter.
Correlate authentication logs with plugin request logs to identify admin sessions producing malformed query strings.

Monitoring Recommendations

Monitor the wp_users and wp_options tables for unexpected read patterns or bulk enumeration.
Track administrator logins and flag sessions that immediately access plugin admin pages with unusual query parameters.
Review WordPress plugin update status and audit logs for the installed version of SEO Booster across all managed sites.

How to Mitigate CVE-2026-15458

Immediate Actions Required

Update the SEO Booster plugin to the patched release published after version 7.3.1, per the WordPress SEO Booster Changeset.
Audit all WordPress administrator accounts and rotate credentials that may have accessed the site during the exposure window.
Review database audit logs for evidence of injection attempts against the sort_field parameter.

Patch Information

The vendor released a fix tracked in changeset 3606177 on the WordPress plugin repository. The patched code introduces proper handling of the sort_field parameter and eliminates the unsafe interpolation observed on lines 389, 404, and 406 of seo-booster.php. Site administrators should upgrade to the latest available version through the WordPress plugin update mechanism.

Workarounds

Deactivate and remove the SEO Booster plugin until the update can be applied.
Restrict administrator account access using strong multi-factor authentication (MFA) to reduce the pool of accounts capable of exploiting the flaw.
Deploy WAF rules that block requests to SEO Booster endpoints containing SQL metacharacters in the sort_field parameter.

bash

# Example WAF rule (ModSecurity) blocking SQL metacharacters in sort_field
SecRule ARGS:sort_field "@rx (?i)(union|select|sleep\(|information_schema|--|/\*)" \
    "id:1015458,phase:2,deny,status:403,\
    msg:'CVE-2026-15458 SEO Booster sort_field SQLi attempt'"