CVE-2026-7624 is an authorization bypass vulnerability (CWE-862) in the SEO Plugin by Squirrly SEO for WordPress, affecting all versions up to 12.4.16. The plugin fails to properly verify that a user has the required administrator-level capability (sq_manage_settings) before allowing execution of sensitive Squirrly cloud API operations, including revocation of Google Search Console and Google Analytics integrations. Authenticated users with contributor-level privileges or higher can exploit this to invoke privileged state-changing API endpoints such as api/gsc/revoke and api/ga/revoke, which should be restricted to administrators only.

The vulnerability allows users with contributor-level access or above to perform privileged actions that should be limited to administrators. Specifically, attackers can revoke the site's Google Search Console and Google Analytics integrations, potentially disrupting site analytics and search console data management. There is no direct confidentiality or availability impact reported. The CVSS v3.1 base score is 4.3 (medium severity), reflecting low complexity and limited impact on confidentiality and availability.

No official patch or remediation is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates and apply any official fixes once available. Until a fix is released, restrict contributor-level access to trusted users only and consider disabling or limiting use of the affected plugin features if possible. Avoid granting contributor or higher privileges to untrusted users to reduce risk.