Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-15946— Search Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Whitelabel Password Modification via handle_whitelabel_password_early Function

Quick assessment

Affected
shahrukhlinkgraph Search Atlas SEO – OTTO AI SEO Automation for WordPress
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件“Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization”在包括 2.6.23 及更早的所有版本中，存在授权绕过漏洞。原因是该插件未正确验证用户是否具备执行某项操作的权限。这使得拥有“订阅者（Subscriber）”及以上权限的已认证攻击者，能够将白标（whitelabel）设置中的密码覆盖为攻击者可控的值，从而解锁受白标保护的后台设置选项卡，包括白标（whi

CVSS 4.3 · Medium

Possible ATT&CK Techniques 1 AI

T1078 · Valid Accounts
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-15946

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Search Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Whitelabel Password Modification via handle_whitelabel_password_early Function
Source: CVE Program / CVE List V5
Vulnerability Description
The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.23. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the whitelabel settings password to an attacker-controlled value, enabling them to unlock whitelabel-protected admin settings tabs including whitelabel, general, and advanced configuration.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
shahrukhlinkgraph Search Atlas SEO – OTTO AI SEO Automation for WordPress 0 ~ 2.6.23 -

II. Public POCs for CVE-2026-15946

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-15946

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-15946 (1)

Other References for CVE-2026-15946 (1)

Other References for CVE-2026-15946 (2)

IV. Related Vulnerabilities

Same product: Search Atlas SEO – OTTO AI SEO Automation for WordPress
Same vendor: shahrukhlinkgraph
Same weakness: CWE-862

V. Comments for CVE-2026-15946

No comments yet

Leave a comment