CVE-2026-15660 Overview
The SEO Booster plugin for WordPress contains a Missing Authorization vulnerability in versions up to and including 7.4.7. The flaw resides in the handle_oauth_callback() function, which is hooked to admin_init and processes $_GET['access_token'] and $_GET['google_email'] without verifying the caller's role or capability. Authenticated attackers with Subscriber-level access or higher can overwrite the seobooster_access_token, seobooster_google_email, and seobooster_gsc_sites options and delete the seobooster_needs_reauth flag. This disrupts the Google Search Console integration and injects attacker-supplied data into site options via an outbound Google API request whose response is stored.
Critical Impact
Low-privileged WordPress users can hijack the Google Search Console OAuth binding, overwrite stored options, and inject attacker-controlled data into the site through a crafted /wp-admin/ request.
Affected Products
- SEO Booster plugin for WordPress, versions up to and including 7.4.7
- WordPress sites with the Google Search Console integration enabled through SEO Booster
- Any site permitting Subscriber-level or higher user registration where the plugin is active
Discovery Timeline
- 2026-09-19 - CVE-2026-15660 published to the National Vulnerability Database
- 2026-09-21 - Last updated in NVD database
Technical Details for CVE-2026-15660
Vulnerability Analysis
The vulnerability is a Missing Authorization flaw [CWE-862] in the SEO Booster plugin's OAuth callback handler. The handle_oauth_callback() function is registered on the admin_init action, which fires for any authenticated user reaching the /wp-admin/ interface, including Subscribers. The handler reads $_GET['access_token'] and $_GET['google_email'] directly and updates persistent plugin options without a current_user_can() capability check or a nonce verification. An attacker only needs a valid low-privileged session to trigger the callback path with attacker-controlled parameters.
Root Cause
The root cause is the absence of an authorization gate on a privileged administrative action. The admin_init hook is not a security boundary; it executes for any logged-in user who loads an admin URL. Because the callback function writes to options that govern a third-party API integration and consumes attacker-supplied tokens for outbound requests, it must be restricted to users holding an administrative capability such as manage_options and validated with a nonce.
Attack Vector
Exploitation requires network access, an authenticated Subscriber-level or higher account, and a crafted URL under /wp-admin/ that supplies access_token and google_email query parameters. When the victim account requests this URL, the plugin overwrites the seobooster_access_token, seobooster_google_email, and seobooster_gsc_sites options, clears the seobooster_needs_reauth flag, and issues an outbound Google API call using the attacker's token. The response is stored in site options, giving the attacker an indirect write primitive into plugin-managed data and breaking the legitimate Google Search Console integration.
See the Wordfence Vulnerability Analysis and the vulnerable code paths in seo-booster.php line 243, line 546, and line 547 for technical details.
Detection Methods for CVE-2026-15660
Indicators of Compromise
- Unexpected changes to the seobooster_access_token, seobooster_google_email, or seobooster_gsc_sites values in the wp_options table.
- Absence or clearing of the seobooster_needs_reauth flag without a corresponding administrator-initiated OAuth flow.
- Web server access logs showing requests to /wp-admin/ containing access_token= and google_email= query parameters from Subscriber-level user sessions.
- Outbound HTTP requests from the WordPress host to Google API endpoints that do not correlate with legitimate administrator activity.
Detection Strategies
- Audit wp_options for the SEO Booster keys and compare current values against a known-good baseline captured before the patch.
- Alert on any HTTP GET to /wp-admin/ where query parameters include both access_token and google_email, especially from non-admin session cookies.
- Correlate WordPress user-role telemetry with admin-context requests to surface Subscriber accounts touching admin URLs.
Monitoring Recommendations
- Enable WordPress audit logging for option changes and role-scoped admin-area access.
- Forward web server and WordPress logs to a centralized analytics platform such as Singularity Data Lake for retention and correlation across sessions.
- Monitor plugin version inventory across managed WordPress hosts and flag any instance running SEO Booster at or below version 7.4.7.
How to Mitigate CVE-2026-15660
Immediate Actions Required
- Upgrade the SEO Booster plugin to a version above 7.4.7 that includes the authorization fix.
- Rotate any Google OAuth tokens and Google Search Console credentials previously stored by the plugin.
- Review Subscriber and low-privileged accounts on the site and remove any that are unrecognized.
- Inspect wp_options for tampered SEO Booster keys and restore known-good values.
Patch Information
The vendor fix is published in the plugin repository. See the WordPress SEO Booster changeset 3665611 for the code change that adds the missing authorization check to the OAuth callback path.
Workarounds
- Disable the SEO Booster plugin until the patched version can be installed.
- Restrict WordPress user registration and set the default role to a non-privileged value to reduce the pool of authenticated attackers.
- Place /wp-admin/ behind an IP allowlist or a web application firewall rule that blocks requests containing access_token and google_email query parameters from non-administrator sessions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.