Executive brief
The SEO Booster plugin for WordPress, which helps website owners optimize their search engine rankings, contains a security flaw. An attacker with administrator-level access can exploit this vulnerability to run unauthorized database commands. This could allow them to steal sensitive information from the website's database, potentially compromising user data or site configuration.
Technical details
The SEO Booster plugin for WordPress is vulnerable to SQL Injection via the 'sort_field' parameter in versions up to and including 7.3.1. The vulnerability stems from insufficient escaping of user-supplied input and a lack of proper SQL query preparation (parameterization). An authenticated attacker with administrator-level privileges can exploit this over the network to append malicious SQL queries to existing database calls. This allows for the extraction of sensitive data from the WordPress database. A changeset indicates that a fix has been developed to address the improper neutralization of special elements in SQL commands.
Affected products
- cleverplugins SEO Booster up to, and including, 7.3.1
Timeline
- 2026-07-16: advisory: NVD publication date
- 2026-07-16: disclosed: Wordfence disclosure date
References
- https://plugins.trac.wordpress.org/browser/seo-booster/tags/7.3.1/seo-booster.php
- https://plugins.trac.wordpress.org/browser/seo-booster/tags/7.3.1/seo-booster.php
- https://plugins.trac.wordpress.org/browser/seo-booster/tags/7.3.1/seo-booster.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3606177%40seo-booster&new=3606177%40seo-booster
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ffcf8071-89be-484c-9b6a-8b08e12cf100?source=cve