Executive brief
The Search Atlas SEO plugin for WordPress, which helps websites manage their search engine visibility, contains a security flaw in its Google Indexing integration. This vulnerability allows any logged-in user, even those with minimal permissions like subscribers, to submit or remove the website's pages from Google's search index. This could lead to legitimate content being removed from search results and the exhaustion of the site's daily Google API quota.
Technical details
The Search Atlas SEO (metasync) plugin fails to implement proper authorization (capability checks) or CSRF protection (nonces) in the 'metasync_send_giapi' AJAX handler. An authenticated attacker with low-level privileges, such as a Subscriber, can send crafted requests to wp-admin/admin-ajax.php to trigger the site's Google Indexing API integration. This allows the attacker to use the site's stored service-account credentials to add or remove URLs from Google's index and consume the site's API quota. The issue is resolved in version 2.6.12.
Affected products
- Search Atlas Search Atlas SEO (metasync) < 2.6.12
Timeline
- 2026-07-10: disclosed: Initial public disclosure by WPScan
- 2026-07-30: advisory: NVD publication date