Description

The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.23. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the whitelabel settings password to an attacker-controlled value, enabling them to unlock whitelabel-protected admin settings tabs including whitelabel, general, and advanced configuration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-19T08:16:52.917Z",
  "pubdate": "2026-09-19T08:16:52.917Z",
  "executiveSummary": "The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress contains a critical authorization bypass vulnerability due to inadequate access control validation. This security flaw affects all versions up to and including 2.6.23. The vulnerability enables authenticated users with minimal privileges—specifically, those with subscriber-level access or higher—to perform unauthorized configuration modifications.\nThe primary impact of this flaw is the ability for an attacker to overwrite the plugin's whitelabel settings password. By successfully modifying this credential, an attacker can bypass the intended access restrictions for restricted administrative settings tabs, including whitelabel configurations, general settings, and advanced plugin management consoles. This constitutes a privilege escalation scenario where restricted plugin functionalities become accessible to unauthorized parties. Given that the plugin manages SEO and AI optimization parameters, unauthorized access may lead to configuration tampering, potential data leakage, or the modification of site-wide search engine optimization strategies. The attack requires authenticated access, but because subscriber accounts are frequently registration-enabled on WordPress installations, the risk profile for public-facing sites is significant.",
  "technicalDetails": "The vulnerability resides within the plugin's internal authorization logic, which fails to implement granular capability checks for administrative actions. Specifically, the component responsible for processing whitelabel setting updates lacks a verification mechanism to ensure that the invoking user possesses the 'manage_options' or equivalent administrative capabilities before executing the change request.\nThe root cause is a failure in access control enforcement where the application assumes that any request directed at the configuration update endpoint is legitimate if the user is authenticated. This flaw allows any user session with a subscriber role or higher to transmit an HTTP request to the settings update handler. The handler processes the input—the new password value for the whitelabel settings—without validating the user's role against the plugin's internal security policy.\nThe exploitation flow is as follows: 1. An attacker authenticates to the WordPress instance using a standard subscriber account. 2. The attacker crafts a request, typically a POST request, targeting the specific plugin endpoint responsible for updating whitelabel settings. 3. The attacker injects a new password value into the request payload. 4. Due to the lack of server-side authorization checks, the plugin accepts the request, overwriting the legitimate whitelabel protection password with the attacker-provided string. 5. Once the password is overwritten, the attacker utilizes the known, attacker-controlled password to authenticate against the plugin's restricted admin tabs.\nPost-exploitation, the attacker gains full visibility and control over the plugin’s 'whitelabel', 'general', and 'advanced' configuration modules. This allows for the manipulation of SEO settings, the potential injection of malicious redirects, or the alteration of AI-driven optimization strategies. Because the plugin interfaces deeply with the WordPress publishing workflow, this authorization bypass effectively grants the attacker administrative-level control over the site's SEO configuration, circumventing the intended security posture designed to restrict these settings to authorized administrators only."
}