CVE-2026-15660 | CVSS: 4.3 | 严重级别: MEDIUM
The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handle_oauth_callback() function which is hooked to admin_init and processes $_GET['access_token'] and $_GET['google_email'] without verifying the caller's role. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the seobooster_access_token, seobooster_google_email, and seobooster_gsc_sites options and delete the seobooster_needs_reauth flag by visiting a crafted /wp-admin/ URL
参考链接:
• https://plugins.trac.wordpress.org/browser/seo-booster/tags/7.3.2/seo-booster.ph
• https://plugins.trac.wordpress.org/browser/seo-booster/tags/7.3.2/seo-booster.ph
• https://plugins.trac.wordpress.org/browser/seo-booster/tags/7.3.2/seo-booster.ph
📌 数据来源: NVD 官方