What is the CVSS score of CVE-2026-15445?

CVE-2026-15445 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

SEO Booster CVE-2026-15445

EUVD-2026-44864 MEDIUM

SQL Injection (CWE-89)

2026-07-16 Wordfence

GHSA-5cpx-56hx-wvjh

WordPress SQLi Wordpress Plugin Seo Booster Cleverplugins

4.9

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.9 MEDIUM

Administrator credentials required to reach the vulnerable GSC list table; read-only blind injection yields no integrity or availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 04:46 vuln.today

CVE Published

Jul 16, 2026 - 03:44 cve.org

MEDIUM 4.9

DescriptionCVE.org

The SEO Booster plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Although esc_sql() and sanitize_text_field() are applied, neither neutralizes SQL keywords, commas, parentheses, or subquery syntax in an unquoted ORDER BY context, leaving the clause fully attacker-controlled.

AnalysisAI

Time-based SQL injection in the SEO Booster WordPress plugin (versions up to and including 7.3.1) allows authenticated administrators to extract sensitive database contents by manipulating the unquoted 'orderby' parameter in the Google Search Console list table component. The root cause is that developer-applied sanitization functions esc_sql() and sanitize_text_field() fail to neutralize SQL keywords, subquery syntax, commas, or parentheses when used in an ORDER BY clause context, leaving the clause fully attacker-controlled. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS score data was not provided.

Technical ContextAI

The vulnerability resides in the SB_GSC_List_Table class within inc/SB_GSC_List_Table.php (lines 559 and 579), which is loaded via seo-booster-gsc.php. The affected code constructs a dynamic SQL ORDER BY clause by interpolating a user-supplied parameter directly into the query string after applying esc_sql() and sanitize_text_field(). CWE-89 (Improper Neutralization of Special Elements in SQL Commands) applies: these sanitization functions were designed for quoted SQL string contexts and do not prevent injection in an ORDER BY context where no surrounding quotes delimit the value. An attacker can embed time-delay functions such as SLEEP() or conditional expressions that cause measurable latency differences, enabling blind extraction of database contents one bit or character at a time. The CPE cpe:2.3:a:cleverplugins:seo_booster:*:*:*:*:*:*:*:* covers all versions of the plugin by vendor Cleverplugins.

RemediationAI

A patch changeset is available in the WordPress plugin repository at https://plugins.trac.wordpress.org/changeset?reponame=&old=3606177%40seo-booster&new=3606177%40seo-booster - site operators should update the SEO Booster plugin to the first released version incorporating this changeset; a specific fixed release version number is not independently confirmed from the provided data and should be verified in the WordPress plugin changelog before upgrading. If immediate patching is not possible, restrict the WordPress administrator role to the minimum required accounts, enforce strong authentication including MFA for all admin-level users, and consider disabling the Google Search Console integration feature within the plugin settings to remove the vulnerable code path. Note that disabling the GSC feature may impact SEO reporting functionality. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/59f622ee-eccf-4b5b-8fa0-93a4405eb1e9 should be monitored for updated patch version confirmation.