Vulnerabilities / GEO Plugin by Squirrly SEO / WPSEC-2026-0424
GEO Plugin by Squirrly SEO < 14.2.7 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Page SEO Modification
Medium 4.3
CWE-639Fixed in 14.2.7
- ID
- WPSEC-2026-0424
- Plugin
- GEO Plugin by Squirrly SEO (squirrly-seo)
- Affected
- all versions before 14.2.7
- Remediation
- Update to 14.2.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- GEO Plugin by Squirrly SEO on WPSec AttackSurface
- Fix released
- Published
Description
The GEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.2.6. This is due to the SEO save routine accepting a user-supplied, predictable page hash alongside a separate post ID: permission was checked on the post ID while the write went to the SEO row of the hash. This makes it possible for authenticated attackers with Contributor-level access and above to overwrite the SEO data of any page, including the home page, such as its title, redirect or index setting.
References
- https://wpsec.com/vuln/WPSEC-2026-0424/
- https://plugins.svn.wordpress.org/squirrly-seo/tags/14.2.7/
- https://wordpress.org/plugins/squirrly-seo/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS