CVE-2026-15660: cleverplugins seo_booster Missing Authorization

Vulnerability summary

CVE-2026-15660 is a medium (CVSS 4.3) Missing Authorization vulnerability in cleverplugins seo_booster. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 8.7% of scored vulnerabilities.

Timeline

1. 19-09-2026
   PublishedVulnerability first disclosed.
2. 19-09-2026
   Last modifiedVulnerability information updated.

Description

The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handle_oauth_callback() function which is hooked to admin_init and processes $_GET['access_token'] and $_GET['google_email'] without verifying the caller's role. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the seobooster_access_token, seobooster_google_email, and seobooster_gsc_sites options and delete the seobooster_needs_reauth flag by visiting a crafted /wp-admin/ URL, disrupting the Google Search Console integration and injecting attacker-chosen data into site options via the attacker-supplied token that drives an outbound Google API request whose response is stored.

• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.