CVE-2026-15252

MediumCVSS 5.4

Published: 30/07/2026(UTC)Updated: 30/07/2026(UTC)Translated: 30/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

4th percentile - higher than 4% of all known CVEs

Summary

The Search Atlas SEO WordPress plugin before 2.6.12 lacks capability and nonce checks in an AJAX handler, allowing any authenticated user (e.g., Subscriber) to invoke the Google Indexing API, submit or remove site URLs from Google's index, and consume the indexing quota.

Risk Assessment

Risk of unauthorized management of site indexing in Google, potentially affecting search visibility and exhausting API quota.

Recommendation

Update the plugin to version 2.6.12 or later.

Other vulnerabilities in Search Atlas SEO

CVE-2026-57357High
The Search Atlas SEO plugin version 2.6.6 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without requiring authentication.

Original NVD description (English source)

The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX handlers, allowing any authenticated user such as a Subscriber to invoke the site's Google Indexing API integration, submitting or removing the site's URLs from Google's index and consuming its indexing quota.