Search Atlas SEO CVE-2026-15247

Requires a valid authenticated WordPress session at Subscriber privilege level or above - the lowest role assigned to registered users on most WordPress sites. The Search Atlas SEO plugin must be installed and active in a version before 2.6.24. The affected handler fires regardless of whether Google service-account credentials have been previously configured: if credentials exist, the attacker can overwrite or delete them causing integration loss; if no credentials are stored, the attacker can still inject arbitrary values. No special server configuration, non-default plugin settings, or elevated WordPress role is required beyond a basic registered account on the target site.

The CVSS 5.4 Medium score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L accurately reflects the low privilege bar - any subscriber-level account is sufficient - but limits impact appropriately: C:N indicates credentials are not read by the attacker, only corrupted or deleted. Real-world impact is confined to sites that have configured Google service-account credentials in the plugin; on those sites, an attacker can break Google API integrations until credentials are restored. EPSS at 0.14% (4th percentile) and SSVC exploitation=none together indicate no observed in-the-wild abuse, despite a publicly available proof-of-concept from WPScan. SSVC automatable=no suggests that mass-automated exploitation is not straightforward, possibly due to needing knowledge of specific credential key names or API structure. The overall posture is moderate priority: sites with registered user accounts and active Google integrations should patch promptly, but there is no current signal of active mass exploitation.

An attacker who possesses or registers a low-privilege subscriber account on a vulnerable WordPress site sends a crafted HTTP POST request directly to the early-priority settings handler, bypassing nonce and capability checks entirely because the handler performs neither. The attacker overwrites the stored Google service-account credentials with attacker-controlled values or deletes them outright, silently breaking the site's Google Search Console or Analytics connectivity. A publicly available proof-of-concept from WPScan documents the precise request structure needed to trigger this action.