Description
The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handle_oauth_callback() function which is hooked to admin_init and processes $_GET['access_token'] and $_GET['google_email'] without verifying the caller's role. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the seobooster_access_token, seobooster_google_email, and seobooster_gsc_sites options and delete the seobooster_needs_reauth flag by visiting a crafted /wp-admin/ URL, disrupting the Google Search Console integration and injecting attacker-chosen data into site options via the attacker-supplied token that drives an outbound Google API request whose response is stored.
References5
- plugins.trac.wordpress.org/browser/seo-booster/tags/7.3.2/seo-b…
- plugins.trac.wordpress.org/browser/seo-booster/tags/7.3.2/seo-b…
- plugins.trac.wordpress.org/browser/seo-booster/tags/7.3.2/seo-b…
- plugins.trac.wordpress.org/changeset?reponame=&old=3665611%40se…
- www.wordfence.com/threat-intel/vulnerabilities/id/3fd58af7-e8ef…
Metrics
- CVSS 3.1
-
4.3
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - EPSS — exploit probability
- 0% percentile: 27 · as of 8 November 2026
- CWE
- CWE-862
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.