Executive brief
The SEO Booster plugin for WordPress, which helps websites optimize their search engine rankings, contains a security flaw in how it handles database queries. An attacker with administrator-level access can exploit this to run unauthorized database commands and extract sensitive information. This could lead to the exposure of private site data or user information stored in the database.
Technical details
The SEO Booster plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in versions up to 7.3.1. The vulnerability stems from insufficient escaping of user-supplied input and a lack of SQL query preparation. While the plugin utilizes esc_sql() and sanitize_text_field(), these functions do not neutralize SQL keywords or subquery syntax when used in an unquoted ORDER BY context. An authenticated attacker with administrator-level privileges can leverage this to append additional SQL queries and extract sensitive data from the database. A patch appears to be available in newer versions based on changeset references.
Affected products
- CleverPlugins SEO Booster up to, and including, 7.3.1
Timeline
- 2026-07-16: disclosed
- 2026-07-16: advisory
References
- https://plugins.trac.wordpress.org/browser/seo-booster/trunk/inc/SB_GSC_List_Table.php
- https://plugins.trac.wordpress.org/browser/seo-booster/trunk/inc/SB_GSC_List_Table.php
- https://plugins.trac.wordpress.org/browser/seo-booster/trunk/seo-booster-gsc.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3606177%40seo-booster&new=3606177%40seo-booster
- https://www.wordfence.com/threat-intel/vulnerabilities/id/59f622ee-eccf-4b5b-8fa0-93a4405eb1e9?source=cve