CVE-2026-15458 describes an SQL Injection vulnerability in the cleverplugins SEO Booster WordPress plugin. The flaw exists in the handling of the 'sort_field' parameter, which is not properly escaped or prepared before being incorporated into SQL queries. Authenticated attackers with administrator privileges can exploit this to append malicious SQL commands, potentially extracting sensitive data from the backend database. The vulnerability affects all versions up to and including 7.3.1. There is no vendor advisory or patch information available at this time.

Successful exploitation allows an authenticated administrator to perform unauthorized SQL queries, leading to the potential disclosure of sensitive information stored in the database. The vulnerability does not impact integrity or availability according to the CVSS vector, but confidentiality is rated high. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for suspicious activity related to the 'sort_field' parameter. Avoid using the vulnerable plugin version in high-risk environments.