CVE-2026-1667 is a high-severity vulnerability (CVSS 7.2) in the GEO Plugin by Squirrly SEO for WordPress. The vulnerability arises from missing authorization controls (CWE-862) combined with an API token leak and inadequate input sanitization and output escaping. This enables unauthenticated attackers to create arbitrary posts within the WordPress site. Furthermore, if the Advanced Custom Fields plugin is installed and activated, attackers can inject stored cross-site scripting (XSS) payloads that execute in the context of users visiting the compromised pages. The vulnerability affects all versions up to and including 14.0.0. No official patch or remediation guidance is currently available from the vendor.

Exploitation of this vulnerability allows unauthenticated attackers to create arbitrary posts on the affected WordPress site, potentially leading to content manipulation or defacement. When combined with the Advanced Custom Fields plugin, attackers can inject malicious scripts that execute in users' browsers, enabling stored cross-site scripting attacks. This can lead to session hijacking, credential theft, or other client-side attacks. The vulnerability does not impact availability but compromises confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's API endpoints if possible and monitor for suspicious post creation activity. Consider disabling or limiting the use of the Advanced Custom Fields plugin to reduce the risk of stored XSS exploitation. Follow updates from the plugin vendor for official patches or temporary mitigations.