EUVD-2026-71845
GHSA-qm2q-vjgw-cw4j
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
PR:L reflects minimum subscriber auth required; C:N because credentials are overwritten/deleted, not disclosed; I:L/A:L for integrity and availability impact on Google integrations.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account credentials.
AnalysisAI
Search Atlas SEO WordPress plugin before 2.6.24 allows any subscriber-level authenticated user to overwrite or permanently delete the site's stored Google service-account credentials by invoking a settings-update handler that performs no nonce verification or capability check. Any registered user on an affected WordPress site can trigger this handler via a crafted HTTP request, disrupting Google Search Console, Analytics, or other Google API integrations that depend on those credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid authenticated WordPress session at Subscriber privilege level or above - the lowest role assigned to registered users on most WordPress sites. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.4 Medium score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L accurately reflects the low privilege bar - any subscriber-level account is sufficient - but limits impact appropriately: C:N indicates credentials are not read by the attacker, only corrupted or deleted. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Search Atlas SEO plugin to version 2.6.24 or later, which introduces the missing nonce verification and WordPress capability check in the affected early-priority settings handler. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Search Atlas Seo
View allSearch Atlas SEO WordPress plugin (all versions before 2.6.12) exposes its Google Indexing API integration to any authen
Reflected cross-site scripting in the Search Atlas SEO WordPress plugin (versions 2.6.6 and earlier, distributed under t
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today