CVE-2026-15247: Search Atlas SEO < 2.6.24 - Subscriber+ Google Service Account Credential Overwrite/Deletion
The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Search Atlas SEO (WordPress plugin)to a version that resolves this vulnerability.Fixed in 2.6.24
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated WordPress user, including a Subscriber-level account, can overwrite or delete the stored Google service-account credentials.
What must an attacker have to exploit it?
The attacker needs an authenticated account on the affected WordPress site. No additional capability requirement is enforced by the vulnerable settings-update handler.
Are sites running version 2.6.24 affected?
The issue affects versions before 2.6.24. The provided information does not indicate that version 2.6.24 or later is affected.
How can an administrator tell whether credentials may have been changed?
Review the plugin's stored Google service-account credentials and check whether they have been overwritten or deleted. The provided information does not identify specific logs, indicators, or recovery steps.