Vulnerabilities / GEO Plugin by Squirrly SEO / WPSEC-2026-0426
GEO Plugin by Squirrly SEO < 14.2.7 - Authenticated (Editor+) Missing Authorization to Arbitrary Plugin Settings Update
Low 2.7
CWE-862Fixed in 14.2.7
- ID
- WPSEC-2026-0426
- Plugin
- GEO Plugin by Squirrly SEO (squirrly-seo)
- Affected
- all versions before 14.2.7
- Remediation
- Update to 14.2.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- GEO Plugin by Squirrly SEO on WPSec AttackSurface
- Fix released
- Published
Description
The GEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 14.2.6. This is due to the Rankings, Focus Pages and Check SEO screens, which are available to Editors, passing the entire submitted form to the general settings saver instead of only the settings they display. This makes it possible for authenticated attackers with Editor-level access and above to change any plugin setting.
References
- https://wpsec.com/vuln/WPSEC-2026-0426/
- https://plugins.svn.wordpress.org/squirrly-seo/tags/14.2.7/
- https://wordpress.org/plugins/squirrly-seo/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS