CVE-2026-15445

Name of the Vulnerable Software and Affected Versions SEO Booster versions prior to 7.3.2

Description An issue exists where authenticated attackers with administrator-level access and above can perform a time-based SQL Injection. This occurs because the orderby parameter is not sufficiently escaped and the SQL query is not properly prepared. Although esc sql() and sanitize text field() are used, they do not neutralize SQL keywords, commas, parentheses, or subquery syntax within an unquoted ORDER BY context, allowing the clause to be controlled by the attacker to extract sensitive information from the database.

Recommendations Update SEO Booster to version 7.3.2 or later. As a temporary mitigation, restrict administrator-level access to the plugin settings to minimize the risk of exploitation.