CVE-2026-7624
Description
The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.4.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to invoke privileged state-changing Squirrly cloud API operations, such as revoking the site's Google Search Console and Google Analytics integrations via api/gsc/revoke and api/ga/revoke, that are otherwise restricted to administrator-level users holding the sq_manage_settings capability.
Affected products
1- Range: <=12.4.16
Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"The plugin fails to properly verify user capabilities before executing privileged API actions."
Attack vector
An authenticated attacker with contributor-level access can bypass authorization checks to invoke sensitive Squirrly Cloud API operations. Specifically, they can call the `api/gsc/revoke` and `api/ga/revoke` endpoints. These actions are normally restricted to administrators who possess the `sq_manage_settings` capability.
Affected code
The vulnerability lies in the plugin's handling of API requests, where authorization checks are insufficient. The specific endpoints `api/gsc/revoke` and `api/ga/revoke` are mentioned as being susceptible to this bypass.
What the fix does
The patch is not provided in the bundle. The advisory indicates that the vulnerability is fixed in version 12.4.17. Users should update to this version to mitigate the risk of unauthorized access to privileged API operations.
Preconditions
- authThe attacker must be authenticated with at least contributor-level access.
Generated on Jun 6, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
14- plugins.trac.wordpress.org/browser/squirrly-seo/tags/12.4.15/classes/RemoteController.phpnvd
- plugins.trac.wordpress.org/browser/squirrly-seo/tags/12.4.15/classes/RemoteController.phpnvd
- plugins.trac.wordpress.org/browser/squirrly-seo/tags/12.4.15/controllers/Post.phpnvd
- plugins.trac.wordpress.org/browser/squirrly-seo/tags/12.4.15/controllers/Post.phpnvd
- plugins.trac.wordpress.org/browser/squirrly-seo/tags/12.4.16/classes/RemoteController.phpnvd
- plugins.trac.wordpress.org/browser/squirrly-seo/tags/12.4.16/classes/RemoteController.phpnvd
- plugins.trac.wordpress.org/browser/squirrly-seo/tags/12.4.16/controllers/Post.phpnvd
- plugins.trac.wordpress.org/browser/squirrly-seo/tags/12.4.16/controllers/Post.phpnvd
- plugins.trac.wordpress.org/browser/squirrly-seo/trunk/classes/RemoteController.phpnvd
- plugins.trac.wordpress.org/browser/squirrly-seo/trunk/classes/RemoteController.phpnvd
- plugins.trac.wordpress.org/browser/squirrly-seo/trunk/controllers/Post.phpnvd
- plugins.trac.wordpress.org/browser/squirrly-seo/trunk/controllers/Post.phpnvd
- plugins.trac.wordpress.org/changesetnvd
- www.wordfence.com/threat-intel/vulnerabilities/id/32701ae6-004c-41e2-bdf0-d78c6c2b3e97nvd
News mentions
0No linked articles in our index yet.