Executive brief
Search Atlas SEO is a WordPress plugin that integrates Google Search Console indexing and SEO controls into WordPress sites. The plugin contains a missing authorization check that allows any logged-in user (even with minimal Subscriber privileges) to overwrite or delete the site's stored Google service-account credentials. An attacker could redirect the site's search indexing to attacker-controlled infrastructure or disable indexing entirely, disrupting the site's search visibility and operations.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the plugin's early-priority AJAX handlers (`meta_sync_save_settings` and `meta_sync_save_seo_controls`). Although a nonce check exists in a secondary handler, it runs after the primary ungated handler has already committed the credential change to the WordPress options table. The plugin processes unauthenticated requests with HTTP 400, but any authenticated user can invoke the AJAX action and modify or delete Google service-account credentials via POST parameters or multipart file upload. An attacker with a Subscriber account (or any logged-in role) can overwrite credentials with attacker-controlled values or delete them entirely, achieving privilege escalation and site compromise. The fix is available in version 2.6.24.
Affected products
- Search Atlas SEO before 2.6.24
Timeline
- 2026-09-03: disclosed
- 2026-09-05: advisory
- 2026-09-05: patched: Fixed in version 2.6.24