Security Alert Summary
The SEO Booster plugin for WordPress contains an SQL injection vulnerability in the sort_field parameter in all versions up to and including 7.3.1. The issue is caused by insufficient escaping of user-supplied input and lack of prepared query handling, which allows authenticated users with administrator-level access to append additional SQL to existing queries and potentially extract sensitive data from the database.
CVE Details
- CVE ID: CVE-2026-15458
- Affected component: SEO Booster plugin for WordPress (vendor: cleverplugins)
- Affected versions: All versions up to and including 7.3.1
- Published: July 16, 2026 at 5:16:18 AM UTC
- Last modified: July 16, 2026 at 1:39:36 PM UTC
- CVSS v3.1: Base score 4.9 (MEDIUM) — Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Authentication / privileges / user interaction: Authentication required; attacker must have administrator-level privileges (Privileges Required: HIGH); User Interaction: None
- Primary impact: Confidentiality: High; Integrity: None; Availability: None
- Weakness (CWE): CWE-89 (SQL Injection)
Technical Details
The plugin fails to properly escape or parameterize the user-supplied sort_field parameter when constructing an SQL query. Because input is concatenated into an existing SQL statement without sufficient preparation or escaping, an authenticated attacker with administrator-level access can append additional SQL statements or fragments to the query.
The vulnerability is a classic SQL injection (CWE-89). The description indicates the flaw stems from insufficient escaping of the sort_field parameter and lack of sufficient preparation of the SQL statement, which together permit injection of arbitrary SQL payloads by privileged users.
Impact is limited to the ability to read or extract sensitive information from the database (confidentiality impact). The CVSS data indicates no direct integrity or availability impact based on the evaluated vector.
How This Could Impact Your Website
In a realistic site environment, a site owner may grant administrator accounts to internal staff or external contractors for maintenance and content work. If any administrator account is compromised or misused, an attacker with that level of access could exploit the sort_field SQL injection to retrieve sensitive data from the database. This might include internal user email addresses, profile information, or other stored data that could be used for targeted phishing or social engineering campaigns against staff and contributors.
For example, an agency contractor given admin access to manage SEO settings could unintentionally provide an entry point that allows SQL queries to enumerate user records. The exposed information could then be used to craft convincing phishing emails aimed at other administrators or staff.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Restrict administrator access to trusted personnel and review user accounts regularly.
- Review and reduce unnecessary user roles, especially contributors and higher-privilege accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and database access logs for unusual behavior or queries.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/seo-booster/tags/7.3.1/seo-booster.php#L389
- https://plugins.trac.wordpress.org/browser/seo-booster/tags/7.3.1/seo-booster.php#L404
- https://plugins.trac.wordpress.org/browser/seo-booster/tags/7.3.1/seo-booster.php#L406
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3606177%40seo-booster&new=3606177%40seo-booster
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ffcf8071-89be-484c-9b6a-8b08e12cf100?source=cve
