CVE-2026-15660: Cleverplugins Seo Booster

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handle_oauth_callback() function which is hooked to admin_init and processes $_GET['access_token'] and $_GET['google_email'] without verifying the caller's role. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the seobooster_access_token, seobooster_google_email, and seobooster_gsc_sites options and delete the seobooster_needs_reauth flag by visiting a crafted /wp-admin/ URL, disrupting the Google Search Console integration and injecting attacker-chosen data into site options via the attacker-supplied token that drives an outbound Google API request whose response is stored.

Affected products

• Cleverplugins Seo Booster: up to and including 7.4.7

Published 2026-09-19. Last modified 2026-09-21.