Answer in brief
CVE-2026-15660 records a Medium severity (CVSS 4.3) vulnerability in SEO Booster <= 7.4.7 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Modification via handle_oauth_callback(). The current sources do not mark it as known exploited. The current feed maps cleverplugins/SEO Booster (generic), cleverplugins/SEO Booster (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 4.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps cleverplugins/SEO Booster (generic), cleverplugins/SEO Booster (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| cleverplugins/SEO Boostergeneric | >=0 <=7.4.7 | Not reported |
| cleverplugins/SEO Boostergeneric | 0 | Not reported |
Published upstream
Sep 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 19, 2026
The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handle_oauth_callback() function which is hooked to admin_init and processes $_GET['access_token'] and $_GET['google_email'] without verifying the caller's role. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the seobooster_access_token, seobooster_google_email, and seobooster_gsc_sites options and delete the seobooster_needs_reauth flag by visiting a crafted /wp-admin/ URL, disrupting the Google Search Console integration and injecting attacker-chosen data into site options via the attacker-supplied token that drives an outbound Google API request whose response is stored.
Quoted source text, attributed separately from HOL analysis.