CVE-2026-52714: WordPress SEO Plugin by Squirrly SEO plugin <= 12.4.16 - Broken Access Control vulnerability

Synopsis

A broken access control vulnerability affects the SEO Plugin by Squirrly SEO for WordPress at version 12.4.16 and earlier. The flaw is reachable over the network with no authentication required, though exploitation depends on meeting specific conditions reflected in the high attack complexity rating. Successful exploitation allows an attacker to modify data or settings controlled by the plugin, bypassing the access restrictions intended to protect those resources. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so the attacker must be able to reach the WordPress installation via HTTP/HTTPS.

• AuthenticationNot required

  No account or session token is needed; the attacker can send unauthenticated requests directly to the affected endpoint.

• Victim interactionNot required

  Exploitation is entirely attacker-driven and does not require any action from a logged-in user or site visitor.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must satisfy specific conditions or timing requirements beyond simple network access, such as targeting a particular request sequence or race condition, before the access control bypass succeeds.

Blast Radius

• An attacker can overwrite or manipulate SEO plugin settings, potentially redirecting search-engine metadata, altering sitemap configurations, or defacing SEO-controlled content fields.
• Integrity of SEO data managed by the plugin is compromised, which can harm search rankings or inject attacker-controlled values into page metadata served to end users.
• No confidential data disclosure or service disruption is indicated by the CVSS impact tokens; the confirmed impact is confined to unauthorized data or configuration modification.