CVE-2026-7624

Name of the Vulnerable Software and Affected Versions SEO Plugin by Squirrly SEO versions prior to 12.4.17

Description The plugin fails to properly verify if a user is authorized to perform specific actions. This allows authenticated attackers with contributor-level access or higher to execute privileged state-changing cloud API operations. Specifically, attackers can revoke Google Search Console and Google Analytics integrations using the endpoints "api/gsc/revoke" and "api/ga/revoke". These operations are intended to be restricted to administrator-level users possessing the sq manage settings capability.

Recommendations Update to a version later than 12.4.16.