CVE-2026-7624
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The SEO Plugin by Squirrly SEO for WordPress up to version 12.4.16 contains an authorization bypass vulnerability. Authenticated attackers with contributor-level access or higher can invoke privileged Squirrly cloud API operations, such as revoking Google Search Console and Google Analytics integrations, which are normally restricted to administrators with the sq_manage_settings capability.
Risk Assessment
An attacker can unauthorizedly change the site's SEO configuration, potentially leading to loss of analytics data and integrity of settings.
Recommendation
Update the SEO Plugin by Squirrly SEO to version 12.4.17 or later.
Other vulnerabilities in SEO Plugin by Squirrly SEO
See all- CVE-2026-66614High
Unauthenticated Cross Site Scripting (XSS) vulnerability in SEO Plugin by Squirrly SEO plugin versions up to 14.2.2. An attacker without authentication can inject a malicious script into the page, which executes in the victim's browser.
- CVE-2026-66664High
Cross Site Scripting (XSS) vulnerability in SEO Plugin by Squirrly SEO up to version 14.2.0, allowing an unauthenticated attacker to inject malicious scripts into pages.
Original NVD description (English source)
The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.4.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to invoke privileged state-changing Squirrly cloud API operations, such as revoking the site's Google Search Console and Google Analytics integrations via `api/gsc/revoke` and `api/ga/revoke`, that are otherwise restricted to administrator-level users holding the `sq_manage_settings` capability.