Vulnerabilities / GEO Plugin by Squirrly SEO / WPSEC-2026-0423
GEO Plugin by Squirrly SEO < 14.2.7 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure
Medium 4.3
CWE-639Fixed in 14.2.7
- ID
- WPSEC-2026-0423
- Plugin
- GEO Plugin by Squirrly SEO (squirrly-seo)
- Affected
- all versions before 14.2.7
- Remediation
- Update to 14.2.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- GEO Plugin by Squirrly SEO on WPSec AttackSurface
- Fix released
- Published
Description
The GEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.2.6. This is due to the Live Assistant post lookup (the sq_ajax_get_post AJAX action) returning the full post object for any supplied post ID without checking that the user can edit that post. This makes it possible for authenticated attackers with Contributor-level access and above to read the title, content and password of any post, including private, draft and password-protected posts.
References
- https://wpsec.com/vuln/WPSEC-2026-0423/
- https://plugins.svn.wordpress.org/squirrly-seo/tags/14.2.7/
- https://wordpress.org/plugins/squirrly-seo/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS