CVE-2026-7624: SEO Plugin by Squirrly SEO <= 12.4.16 - Missing Authorization to Authenticated (Contributor+) Privileged Cloud API Operations
The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.4.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to invoke privileged state-changing Squirrly cloud API operations, such as revoking the site's Google Search Console and Google Analytics integrations via api/gsc/revoke and api/ga/revoke, that are otherwise restricted to administrator-level users holding the sqmanagesettings capability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SEO Plugin by Squirrly SEOfrom your environment.If the plugin is not required, uninstall the SEO Plugin by Squirrly SEO from affected sites to mitigate the authorization bypass.
- Configuration
Verify and remove the 'sq_manage_settings' capability from contributor and other non-administrator roles so that only Administrator accounts retain this capability.
WordPress role capabilities (Squirrly plugin) sq_manage_settings capability assignment = ensure only Administrator role retains sq_manage_settings - Compensating control
Block or restrict access to the Squirrly cloud API endpoints (e.g., api/gsc/revoke and api/ga/revoke) via WAF, webserver rules, or firewall so only trusted administrative IPs or authenticated admin sessions can reach them.
- Operational
Review access logs for calls to api/gsc/revoke and api/ga/revoke and verify Google Search Console and Google Analytics integrations have not been revoked. Reconnect or re-authenticate integrations if they were revoked and remediate any unauthorized changes.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7624?
The severity of CVE-2026-7624 is medium, rated at 4.3 on the CVSS scale.
How do I fix CVE-2026-7624?
To fix CVE-2026-7624, update the Squirrly SEO plugin to version 12.4.17 or later.
What type of vulnerability is CVE-2026-7624?
CVE-2026-7624 is an authorization bypass vulnerability affecting the Squirrly SEO plugin.
Who is affected by CVE-2026-7624?
Authenticated users with Contributor or higher roles are potentially affected by CVE-2026-7624.
What actions are impacted by CVE-2026-7624?
CVE-2026-7624 allows authenticated attackers to perform privileged cloud API operations without proper authorization.