CVE-2026-15946: CWE-862 Missing Authorization in shahrukhlinkgraph Search Atlas SEO – OTTO AI SEO Automation for WordPress
The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.23. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the whitelabel settings password to an attacker-controlled value, enabling them to unlock whitelabel-protected admin settings tabs including whitelabel, general, and advanced configuration.
AI Analysis
Technical Summary
CVE-2026-15946 is an authorization bypass vulnerability (CWE-862) in the Search Atlas SEO – OTTO AI SEO Automation plugin for WordPress. The plugin fails to properly verify user authorization before allowing certain actions. As a result, authenticated users with subscriber-level privileges or higher can overwrite the whitelabel settings password, thereby gaining access to admin settings tabs that are normally protected by whitelabel restrictions. This affects all plugin versions from 0 up to and including 2.6.23.
Potential Impact
The vulnerability allows authenticated low-privilege users to escalate their access by changing the whitelabel settings password to a value they control. This enables unauthorized access to sensitive admin configuration tabs, potentially leading to unauthorized configuration changes. The CVSS score of 4.3 reflects a medium severity impact with integrity loss but no confidentiality or availability impact.
Mitigation Recommendations
No official patch or fix is currently documented. Users should monitor the vendor advisory for updates. Until a fix is available, restrict subscriber-level access to trusted users only and consider disabling or limiting use of the affected plugin. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
CVE-2026-15946: CWE-862 Missing Authorization in shahrukhlinkgraph Search Atlas SEO – OTTO AI SEO Automation for WordPress
Description
The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.23. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the whitelabel settings password to an attacker-controlled value, enabling them to unlock whitelabel-protected admin settings tabs including whitelabel, general, and advanced configuration.
CVSS v3.1
Score 4.3medium
Affected software
shahrukhlinkgraph
Search Atlas SEO – OTTO AI SEO Automation for WordPress
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-15946 is an authorization bypass vulnerability (CWE-862) in the Search Atlas SEO – OTTO AI SEO Automation plugin for WordPress. The plugin fails to properly verify user authorization before allowing certain actions. As a result, authenticated users with subscriber-level privileges or higher can overwrite the whitelabel settings password, thereby gaining access to admin settings tabs that are normally protected by whitelabel restrictions. This affects all plugin versions from 0 up to and including 2.6.23.
Potential Impact
The vulnerability allows authenticated low-privilege users to escalate their access by changing the whitelabel settings password to a value they control. This enables unauthorized access to sensitive admin configuration tabs, potentially leading to unauthorized configuration changes. The CVSS score of 4.3 reflects a medium severity impact with integrity loss but no confidentiality or availability impact.
Mitigation Recommendations
No official patch or fix is currently documented. Users should monitor the vendor advisory for updates. Until a fix is available, restrict subscriber-level access to trusted users only and consider disabling or limiting use of the affected plugin. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-07-16T12:57:00.242Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aae3e0055bf5e2cf54897cd
Added to database: 09/19/2026, 07:47:12 UTC
Last enriched: 09/19/2026, 08:02:50 UTC
Last updated: 09/20/2026, 00:00:09 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.