WordPress SEO Booster <= 7.3.1 Authenticated SQL Injection via sort_field (CVE-2026-15458)

Vulnerability Overview Vulnerability Name: SEO Booster <= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'sort_field' Parameter Vulnerability Description: The SEO Booster plugin contains an SQL injection vulnerability. Attackers can execute arbitrary SQL queries by crafting malicious requests using the parameter, thereby obtaining sensitive information from the database. CVSS Score: 4.9 (Medium) CVE ID: CVE-2026-15458 Release Date: July 15, 2026 Last Updated: July 16, 2026 Researcher: PRISM - Wordfence Affected Scope Affected Versions: SEO Booster <= 7.3.1 Plugin Name: seo-booster Plugin Source: WordPress.org Remediation Fixed Version: Upgrade to version 7.3.2 or higher Patch Status: Fixed Additional Information Reference Links: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org Related Recent Vulnerabilities SEO Booster <= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter - CVE ID: CVE-2026-15445 - CVSS Score: 4.9 - Researcher: PRISM - Release Date: July 15, 2026 SEO Booster <= 6.1.8 - Missing Authorization - CVE ID: CVE-2025-68019 - CVSS Score: 5.3 - Researcher: Legion Hunter - Release Date: January 19, 2026 SEO Booster <= 3.8.9 - Cross-Site Request Forgery - CVE ID: CVE-2024-32438 - CVSS Score: 4.3 - Researcher: Joshua Chan - Release Date: April 12, 2024 Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get - CVE ID: CVE-2023-33999 - CVSS Score: 6.1 - Researcher: Rafie Muhammad - Release Date: July 18, 2023 Freemius SDK <= 2.4.2 - Missing Authorization Checks - CVE ID: CVE-2022-4974 - CVSS Score: 6.3 - Researcher: Rafie Muhammad - Release Date: March 4, 2022 SEO Booster <= 3.7 - Admin+ SQL Injection - CVE ID: CVE-2021-24747 - CVSS Score: 7.2 - Researcher: b14derunner - Release Date: November 15, 2021 Summary The SEO Booster plugin has multiple security vulnerabilities, including SQL injection, cross-site scripting (XSS), and missing authorization issues. Users are advised to upgrade to version 7.3.2 or higher as soon as possible to remediate these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress SEO Booster <= 7.3.1 Authenticated SQL Injection via sort_field (CVE-2026-15458)

More from this source