CVE-2026-15445 is a time-based SQL Injection vulnerability in the SEO Booster WordPress plugin affecting versions up to 7.3.1. The issue is due to improper neutralization of special elements in the 'orderby' parameter of SQL queries. Although esc_sql() and sanitize_text_field() functions are applied, they do not prevent injection of SQL keywords, commas, parentheses, or subquery syntax in an unquoted ORDER BY clause. This allows authenticated users with administrator privileges to append malicious SQL queries to extract sensitive data from the database. No official patch or remediation level is currently documented.

An attacker with administrator-level access can exploit this vulnerability to perform time-based SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not affect confidentiality, integrity, or availability beyond data disclosure, as indicated by the CVSS vector (Confidentiality: High, Integrity: None, Availability: None).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or removing the SEO Booster plugin if possible. Monitor for updates from the vendor and apply patches promptly once released.