What is the CVSS score of CVE-2026-15458?

CVE-2026-15458 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

SEO Booster CVE-2026-15458

EUVD-2026-44867 MEDIUM

SQL Injection (CWE-89)

2026-07-16 Wordfence

GHSA-hh4v-5fxf-qpv6

WordPress SQLi Wordpress Plugin Seo Booster Cleverplugins

4.9

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.9 MEDIUM

Administrator authentication requirement (PR:H) is confirmed by description; read-only SQL extraction yields C:H only with no integrity or availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 04:47 vuln.today

CVE Published

Jul 16, 2026 - 03:44 cve.org

MEDIUM 4.9

DescriptionCVE.org

The SEO Booster plugin for WordPress is vulnerable to generic SQL Injection via the 'sort_field' parameter in all versions up to, and including, 7.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

SQL Injection in the SEO Booster WordPress plugin (versions up to and including 7.3.1) enables authenticated administrators to append arbitrary SQL to existing queries via the unsanitized 'sort_field' parameter, exposing sensitive database contents. The vulnerability resides in seo-booster.php (lines 389, 404, 406) where user-supplied sort input is neither escaped nor parameterized before being incorporated into SQL execution. Despite a high confidentiality impact, exploitation is gated behind WordPress administrator-level credentials (PR:H), substantially limiting the realistic attack surface. No public exploit identified at time of analysis; a WordPress Trac changeset (3606177) suggests a patch has been committed.

Technical ContextAI

CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) describes the root cause: the 'sort_field' parameter accepted by the plugin is concatenated directly into an SQL query without parameterized preparation or adequate escaping. The affected codebase is seo-booster.php by cleverplugins (CPE: cpe:2.3:a:cleverplugins:seo_booster:*:*:*:*:*:*:*:*), a PHP WordPress plugin that interfaces with the WordPress MySQL database. This is a classic second-order or inline SQL injection pattern where attacker-controlled sort column names bypass query preparation, a common weakness in plugins that handle dynamic ORDER BY clauses which cannot be bound as parameterized values in most database abstraction layers without explicit whitelisting.

RemediationAI

Update the SEO Booster plugin to a version beyond 7.3.1; a fix has been committed to the WordPress plugin repository as changeset 3606177 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3606177%40seo-booster&new=3606177%40seo-booster), though an exact patched release version is not independently confirmed in the available data - verify via the WordPress plugin dashboard that you are running the latest available release. If an immediate update is not possible, restrict WordPress administrator access to the smallest necessary set of trusted users, as exploitation requires admin-level authentication; this does not eliminate the vulnerability but removes unprivileged paths to exploitation. Wordfence users should ensure their firewall rules are current, as Wordfence reported this issue and may provide virtual patching coverage.