CVE-2026-15660 is a missing authorization vulnerability (CWE-862) in the SEO Booster WordPress plugin versions up to and including 7.4.7. The handle_oauth_callback() function, hooked to admin_init, processes $_GET parameters 'access_token' and 'google_email' without verifying the caller's role or capabilities. This allows authenticated users with low privileges (Subscriber and above) to overwrite sensitive plugin options such as seobooster_access_token, seobooster_google_email, and seobooster_gsc_sites, and delete the seobooster_needs_reauth flag. The attacker-supplied token influences outbound Google API requests, and the plugin stores the API response, enabling injection of attacker-chosen data into site options.

An attacker with Subscriber-level access or higher can disrupt the Google Search Console integration by overwriting plugin options and deleting flags, potentially injecting malicious or incorrect data into site options. This does not lead to direct confidentiality loss or denial of service but impacts integrity of plugin configuration and integration functionality.

No patch or official fix is currently documented. Administrators should restrict user roles carefully to limit Subscriber-level access and above to trusted users. Monitor for updates from the vendor for an official fix. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.