EUVD-2026-50998
GHSA-4cg6-5xq4-m2fc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Network AJAX endpoint (AV:N, AC:L) requires subscriber authentication (PR:L); no confidentiality impact; integrity and availability limited to indexing API manipulation.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX handlers, allowing any authenticated user such as a Subscriber to invoke the site's Google Indexing API integration, submitting or removing the site's URLs from Google's index and consuming its indexing quota.
AnalysisAI
Search Atlas SEO WordPress plugin (all versions before 2.6.12) exposes its Google Indexing API integration to any authenticated user - including low-privilege subscribers - due to a missing capability and nonce check in an AJAX handler. Any user with a valid WordPress session can invoke the plugin's Google Indexing API endpoint to submit or remove site URLs from Google's search index and exhaust the site's indexing API quota. A publicly available exploit exists via WPScan, though EPSS at 0.14% (4th percentile) and the absence of a CISA KEV listing indicate limited observed exploitation activity at this time.
Technical ContextAI
Search Atlas SEO is a WordPress plugin that integrates with Google's Indexing API, allowing site administrators to programmatically signal URL additions and removals to Google's crawler. The vulnerability resides in a WordPress AJAX handler registered without either a current_user_can() capability check or check_ajax_referer() nonce verification, constituting a textbook CWE-862 (Missing Authorization) flaw. In WordPress, AJAX handlers registered via wp_ajax_ hooks are accessible to all authenticated users by default unless explicitly gated by role or permission checks. Without these controls, a subscriber-tier user can call the handler as if they were an administrator, directing the site's configured Google API credentials to perform indexing operations. Affected product CPE: cpe:2.3:a:unknown:search_atlas_seo:*:*:*:*:*:*:*:*, all versions in the range 0 through below 2.6.12.
RemediationAI
Update the Search Atlas SEO WordPress plugin to version 2.6.12 or later, which adds the missing capability and nonce checks to the affected AJAX handler; this is the only confirmed fix per the WPScan advisory at https://wpscan.com/vulnerability/a347a7a8-36d6-4806-8781-a9ae8eb94788/. If immediate patching is not possible, disabling the Google Indexing API integration within the plugin's settings eliminates the exploitable endpoint entirely, though it also disables all programmatic indexing functionality - weigh this trade-off against SEO workflow dependencies. A secondary compensating control is to disable open user registration on the WordPress site, removing the ability for unauthenticated actors to self-register a subscriber account; note this does not protect against existing low-privilege users. Auditing and removing unnecessary subscriber accounts is also advisable as an interim measure.
More in Search Atlas Seo
View allSearch Atlas SEO WordPress plugin before 2.6.24 allows any subscriber-level authenticated user to overwrite or permanent
Reflected cross-site scripting in the Search Atlas SEO WordPress plugin (versions 2.6.6 and earlier, distributed under t
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today