Executive brief
The Squirrly SEO plugin for WordPress, which helps websites optimize their search engine visibility, contains a security flaw that allows lower-level users to perform administrative actions. An attacker with a basic contributor account could disconnect the website's Google Search Console and Google Analytics integrations. This could disrupt marketing data collection and search engine monitoring operations.
Technical details
The Squirrly SEO plugin for WordPress (versions up to 12.4.16) fails to perform adequate authorization checks on certain state-changing operations. Specifically, the plugin does not verify if a user possesses the 'sq_manage_settings' capability before allowing access to Squirrly cloud API endpoints. This vulnerability (CWE-862) allows authenticated attackers with contributor-level permissions or higher to execute privileged actions, such as revoking Google Search Console and Google Analytics integrations via the 'api/gsc/revoke' and 'api/ga/revoke' endpoints. The issue is rooted in the RemoteController and Post controller classes. Users should update to a version beyond 12.4.16 to mitigate this risk.
Affected products
- Squirrly Squirrly SEO up to, and including, 12.4.16
Timeline
- 2026-06-06: disclosed
- 2026-06-06: advisory
References
- https://plugins.trac.wordpress.org/browser/squirrly-seo/tags/12.4.15/classes/RemoteController.php
- https://plugins.trac.wordpress.org/browser/squirrly-seo/tags/12.4.15/classes/RemoteController.php
- https://plugins.trac.wordpress.org/browser/squirrly-seo/tags/12.4.15/controllers/Post.php
- https://plugins.trac.wordpress.org/browser/squirrly-seo/tags/12.4.15/controllers/Post.php
- https://plugins.trac.wordpress.org/browser/squirrly-seo/tags/12.4.16/classes/RemoteController.php
- https://plugins.trac.wordpress.org/browser/squirrly-seo/tags/12.4.16/classes/RemoteController.php
- https://plugins.trac.wordpress.org/browser/squirrly-seo/tags/12.4.16/controllers/Post.php