What is the CVSS score of CVE-2026-7624?

CVE-2026-7624 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Squirrly SEO CVE-2026-7624

EUVD-2026-34956 MEDIUM

Missing Authorization (CWE-862)

2026-06-06 Wordfence

GHSA-vm37-pv66-hj54

Authentication Bypass Google WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 05:27 vuln.today

CVE Published

Jun 06, 2026 - 03:28 nvd

MEDIUM 4.3

DescriptionCVE.org

The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.4.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to invoke privileged state-changing Squirrly cloud API operations, such as revoking the site's Google Search Console and Google Analytics integrations via api/gsc/revoke and api/ga/revoke, that are otherwise restricted to administrator-level users holding the sq_manage_settings capability.

AnalysisAI

Authorization bypass in the Squirrly SEO WordPress plugin (all versions through 12.4.16) allows authenticated attackers with contributor-level access to invoke privileged Squirrly cloud API operations reserved for administrators, including revoking the site's Google Search Console and Google Analytics integrations via the api/gsc/revoke and api/ga/revoke endpoints. The flaw stems from the plugin's failure to verify the sq_manage_settings capability before processing these state-changing cloud API calls, meaning any contributor can silently destroy critical SEO and analytics data connections without administrator knowledge. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The affected product is identified by CPE cpe:2.3:a:cifi:seo_plugin_by_squirrly_seo:*:*:*:*:*:*:*:* - the Squirrly SEO plugin for WordPress by Cifi Ltd. The root cause is CWE-862 (Missing Authorization): the plugin's request-handling logic in controllers/Post.php (lines 680, 683) and classes/RemoteController.php (lines 51, 573) processes inbound requests that proxy to Squirrly's cloud API without first confirming the calling user holds the sq_manage_settings WordPress capability. In WordPress's role hierarchy, contributors sit well below administrators and are normally limited to draft post creation. Because Squirrly SEO proxies calls to its own SaaS backend rather than performing purely local operations, a successful exploit has external, persistent effects - the revocation of OAuth-style integrations with Google Search Console and Google Analytics - that survive plugin deactivation or reinstallation until an administrator manually re-authenticates.

RemediationAI

An upstream fix has been committed to the WordPress plugin SVN trunk (changeset 3558846 at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3558846%40squirrly-seo&new=3558846%40squirrly-seo); however, the exact released plugin version containing this fix has not been independently confirmed from the available data - site administrators should update to the latest available version via the WordPress plugin dashboard and verify it exceeds 12.4.16. As a compensating control pending update, administrators should audit contributor-level user accounts and minimize the number of users with contributor or higher roles on sites where Squirrly SEO is installed. Administrators can also monitor for unexpected disconnection of Google Search Console or Google Analytics within the Squirrly dashboard as an indicator of abuse. Re-authentication of Google integrations after patching will restore any revoked connections. There is no documented workaround that disables only the vulnerable revoke endpoints without disabling the broader plugin functionality.