CVE-2026-15660: SEO Booster <= 7.4.7 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Modification via handle_oauth_callback()
The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handleoauthcallback() function which is hooked to admininit and processes $GET['accesstoken'] and $GET['googleemail'] without verifying the caller's role. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the seoboosteraccesstoken, seoboostergoogleemail, and seoboostergscsites options and delete the seoboosterneedsreauth flag by visiting a crafted /wp-admin/ URL, disrupting the Google Search Console integration and injecting attacker-chosen data into site options via the attacker-supplied token that drives an outbound Google API request whose response is stored.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress SEO Booster pluginto a version that resolves this vulnerability.Fixed in 7.4.7 - Configuration
Update the SEO Booster plugin so handle_oauth_callback() performs a capability/authorization check and rejects non-privileged users before overwriting seobooster_access_token, seobooster_google_email, and seobooster_gsc_sites options or deleting seobooster_needs_reauth.
WordPress SEO Booster plugin handle_oauth_callback() capability check = Add/require an appropriate capability check before processing $_GET['access_token'] and $_GET['google_email'] on admin_init