SEO Booster <= 7.4.7 — Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Modification via handle_oauth_callback()

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under SEO Booster.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 7.4.8, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch SEO Booster to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Wordfence PRISM.

The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handle_oauth_callback() function which is hooked to admin_init and processes $_GET['access_token'] and $_GET['google_email'] without verifying the caller's role. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the seobooster_access_token, seobooster_google_email, and seobooster_gsc_sites options and delete the seobooster_needs_reauth flag by visiting a crafted /wp-admin/ URL, disrupting the Google Search Console integration and injecting attacker-chosen data into site options via the attacker-supplied token that drives an outbound Google API request whose response is stored.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Sep 18, 2026

   CVE published

   Severity medium, CVSS 4.3

2. Nov 13, 2026

   Record last updated