SEO Booster <=7.3.1 Authenticated SQL Injection via 'orderby' Parameter (CVE-2026-15445)

Vulnerability Overview Vulnerability Name: SEO Booster <= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter CVE ID: CVE-2026-15445 CVSS Score: 4.9 (Medium) Publish Date: July 15, 2026 Last Updated: July 16, 2026 Researcher: PRISM - Wordfence Impact Affected Versions: SEO Booster <= 7.3.1 Vulnerability Type: SQL Injection Vulnerability Description: The SEO Booster plugin for WordPress contains a time-based blind SQL injection vulnerability via the parameter. Due to insufficient sanitization and validation of user-supplied input, existing SQL queries are exploited. This allows attackers with administrator-level privileges to append additional SQL queries to existing ones, thereby extracting sensitive information from the database. Although and are applied, no neutralization is performed on SQL keywords, commas, parentheses, or subquery syntax, resulting in full attacker control over this clause. Remediation Fixed Versions: Upgrade to 7.3.2 or later Patch Version: 7.3.2 Additional Information References: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org Recent Vulnerabilities SEO Booster <= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'sort_field' Parameter - CVE ID: CVE-2026-15458 - CVSS Score: 4.9 - Researcher: PRISM - Publish Date: July 15, 2026 SEO Booster <= 6.1.8 - Missing Authorization - CVE ID: CVE-2025-68019 - CVSS Score: 5.3 - Researcher: Legion Hunter - Publish Date: January 19, 2026 SEO Booster <= 3.8.9 - Cross-Site Request Forgery - CVE ID: CVE-2024-32438 - CVSS Score: 4.3 - Researcher: Joshua Chan - Publish Date: April 12, 2024 Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get - CVE ID: CVE-2023-33999 - CVSS Score: 6.1 - Researcher: Rafe Muhammad - Publish Date: July 18, 2023 Freemius SDK <= 2.4.2 - Missing Authorization Checks - CVE ID: CVE-2022-4974 - CVSS Score: 6.3 - Researcher: Not Provided - Publish Date: March 4, 2022 SEO Booster <= 3.7 - Admin+ SQL Injection - CVE ID: CVE-2021-24747 - CVSS Score: 7.2 - Researcher: bl4dderunner - Publish Date: November 15, 2021 Summary The SEO Booster plugin versions 7.3.1 and below contain an SQL injection vulnerability. Users are advised to upgrade to version 7.3.2 or later as soon as possible to resolve this issue.

Goal Reached Thanks to every supporter — we hit 100%!

SEO Booster <=7.3.1 Authenticated SQL Injection via 'orderby' Parameter (CVE-2026-15445)

More from this source