EUVD-2026-83468
GHSA-q642-cfr5-5536
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Subscriber-level account
-
DeliveryLog into wp-admin
-
ExploitRequest crafted /wp-admin/ URL with access_token & google_email
-
Executionhandle_oauth_callback runs on admin_init without capability check
-
PersistOverwrite GSC/OAuth options and clear reauth flag
-
ImpactInjected token drives stored Google API response, disrupting integration
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the SEO Booster plugin (<=7.4.7) installed and active on WordPress, plus an authenticated account of Subscriber-level or above (PR:L) - most easily obtained on sites allowing open user registration. No user interaction, no admin privileges, and no non-default configuration are needed; the vulnerable handle_oauth_callback() runs on the standard admin_init hook. Exploitation is limited to overwriting the plugin's Google Search Console/OAuth options and requires the attacker to already hold valid credentials, and impact is bounded to integrity of those plugin options (no confidentiality or availability effect). |
| Impact | This is a genuine but low-impact issue best characterized as a broken-access-control (authorization) flaw, not the 'Authentication Bypass' its tag suggests. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N = 4.3, MEDIUM) is internally consistent with the description: network-reachable, low complexity, requires an authenticated Subscriber-level account (PR:L), no user interaction, and only limited integrity impact (I:L) with no confidentiality or availability effect. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no signal of active or imminent widespread exploitation. Impact is confined to corrupting the plugin's Google Search Console/OAuth site options (overwriting seobooster_access_token, seobooster_google_email, seobooster_gsc_sites and clearing seobooster_needs_reauth) - a feature-disruption/data-injection nuisance rather than site takeover. Net: a real, patch-worthy defect but a low real-world priority; prioritize behind any RCE/auth-bypass/high-CVSS plugin issues. Note the attacker must already hold a valid low-privilege account, which further limits opportunistic exploitation on sites that do not allow open registration. |
| Exploit ScenarioDerived | On a WordPress site running SEO Booster <=7.4.7 that permits self-registration, an attacker registers a Subscriber account, logs in, and visits a crafted /wp-admin/ URL carrying attacker-chosen access_token and google_email parameters. Because handle_oauth_callback() runs on admin_init without a capability check, the plugin overwrites the stored Google integration options and issues an outbound Google API call with the attacker's token whose response is persisted, breaking the site's Search Console integration. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 19, 2026
Missing authorization in the SEO Booster plugin for WordPress through version 7.4.7 allows any authenticated user with Subscriber-level access or above to overwrite the plugin's Google Search Console integration options - seobooster_access_token, seobooster_google_email and seobooster_gsc_sites - and to clear the seobooster_needs_reauth flag by simply requesting a crafted /wp-admin/ URL. Because the vulnerable handle_oauth_callback() routine is registered on the standard admin_init hook and only takes attacker-supplied $_GET parameters, the flaw requires nothing more than a low-privileged account (CVSS 3.1 PR:L, no user interaction, no admin rights, no non-default configuration), which is trivial for an attacker to obtain on any site with self-service registration enabled. Impact is bounded to integrity of those plugin settings at CVSS 4.3 with no confidentiality or availability effect, and although the advisory carries an 'Authentication Bypass' tag the underlying issue is classic broken access control; no public exploit code was identified at time of analysis.
RemediationAI
The plugin repository changeset 3665611 indicates an upstream fix has been committed for the handle_oauth_callback() routine, so the primary action is to update SEO Booster to the earliest release after 7.4.7 that contains that change (verify the plugin's changelog or the WordPress.org plugin page before relying on it, because a specific patched version number is not independently confirmed in this data); until then, sites running 7.4.7 or earlier should treat the plugin options as attacker-writable. The most effective compensating control is to eliminate the low-privileged accounts the flaw depends on: disable open user registration (Settings > General > Membership, untick 'Anyone can register') or route new signups through an administrator-approval plugin, accepting that this blocks legitimate self-service account creation. Administrators can additionally restrict access to the /wp-admin/ area by blocking Subscriber-level accounts at the web-server or WAF layer, or by removing unused Subscriber accounts, with the trade-off that any site genuinely using the Subscriber role for members or customers will break. If the Google Search Console integration is not in active use, deactivating SEO Booster removes the attack surface entirely at the cost of losing the plugin's SEO features and any stored configuration; if it is in use, re-authenticate the Search Console connection and inspect the seobooster_access_token, seobooster_google_email and seobooster_gsc_sites options for tampering, since an injected token causes the site to make outbound Google API calls under values chosen by an attacker. Review the advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/3fd58af7-e8ef-4518-bed8-4e20c8e61db7?source=cve and the upstream changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3665611%40seo-booster&new=3665611%40seo-booster for the vendor's own guidance and the exact release in which the fix ships.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SEO Booster is a third-party WordPress plugin maintained by CleverPlugins that links a site to Google Search Console and Google Analytics using OAuth. The vulnerable code path, handle_oauth_callback(), is attached to WordPress's admin_init hook, which fires on essentially every request to /wp-admin/ for a logged-in user before the requested admin page is rendered. The function reads the access_token and google_email values directly from the query string ($_GET) and writes them into the WordPress options table without ever calling current_user_can() or check_admin_referer()/nonce verification, which is the CWE-862 (Missing Authorization) root cause. As a result, an account with only the built-in Subscriber role - a role that normally has no access to plugin settings whatsoever - can drive the callback by navigating to an admin URL carrying attacker-chosen parameters; the supplied token is then used for an outbound call to a Google API whose response is persisted into the plugin's options. The affected code is visible in the tagged 7.3.2 source (notably around lines 243, 546 and 547 of seo-booster.php) and the plugin is tracked under CPE cpe:2.3:a:cleverplugins:seo_booster:*:*:*:*:*:*:*:*, meaning every published release up to and including 7.4.7 inherits the same defective callback. The observable consequences are corruption of the site's Search Console binding, potential error/disruption of search data syncing within the plugin, and storage of attacker-chosen values, while the plugin's own reauthentication prompt can be silently suppressed by deleting the seobooster_needs_reauth flag so the site owner receives no warning. The 'Authentication Bypass' tag attached to this record overstates the flaw: no authentication is bypassed, only authorization is missing once a legitimate low-privilege session exists.
Know when Seo Booster gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-reachable admin_init handler with no capability check, exploitable by any authenticated Subscriber (PR:L), low complexity, integrity-only impact on plugin options; no C or A effect.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handle_oauth_callback() function which is hooked to admin_init and processes $_GET['access_token'] and $_GET['google_email'] without verifying the caller's role. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the seobooster_access_token, seobooster_google_email, and seobooster_gsc_sites options and delete the seobooster_needs_reauth flag by visiting a crafted /wp-admin/ URL, disrupting the Google Search Console integration and injecting attacker-chosen data into site options via the attacker-supplied token that drives an outbound Google API request whose response is stored.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Seo Booster
View allThe SEO Booster WordPress plugin before 3.8 allows for authenticated SQL injection via the "fn_my_ajaxified_dataloader_a
SQL Injection in the SEO Booster WordPress plugin (versions up to and including 7.3.1) enables authenticated administrat
Time-based SQL injection in the SEO Booster WordPress plugin (versions up to and including 7.3.1) allows authenticated a
Cross-Site Request Forgery (CSRF) vulnerability in cleverplugins.Com SEO Booster.8.9. Rated medium severity (CVSS 4.3),
Exploit-DB