Executive brief
The SEO Booster plugin for WordPress fails to verify user permissions before allowing changes to Google Search Console settings. An attacker with even basic subscriber-level access can hijack the Google authentication tokens and options that control the site's search engine integration, potentially injecting malicious data or disrupting the plugin's functionality.
Technical details
The handle_oauth_callback() function hooked to admin_init processes $_GET['access_token'] and $_GET['google_email'] parameters without capability checks, allowing any authenticated user to overwrite seobooster_access_token, seobooster_google_email, and seobooster_gsc_sites options. An attacker can craft a /wp-admin/ URL to modify these options and delete the seobooster_needs_reauth flag, redirecting Google API responses to attacker-controlled data storage.
Affected products
- Wordpress.org SEO Booster up to and including 7.4.7
Timeline
- 2026-09-19: disclosed