CVE-2026-15247 Details
Description
The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account credentials.
A vulnerability exists in the Search Atlas SEO WordPress plugin in versions prior to 2.6.24, where the plugin fails to implement proper nonce or capability checks before handling settings updates. This oversight allows any authenticated user, such as a Subscriber, to overwrite or delete the site's Google service account credentials. The issue arises because the vulnerable AJAX action can be accessed without the necessary authorization checks, enabling unauthorized modifications to sensitive Google integration settings.
Users are advised to update the Search Atlas SEO WordPress plugin to version 2.6.24 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 5, 2026CISA-ADP
Assessed Sep 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/1618ba19-c410-440b-a2d9-1e1526614549/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Search Atlas SEO | < 2.6.24 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 6, 2026 | CVE Modified | CISA-ADP |
| Sep 5, 2026 | New CVE Received | [email protected] |