CVE-2026-15247

The Search Atlas SEO plugin for WordPress versions prior to 2.6.24 is vulnerable due to a lack of nonce or capability checks in its settings update handler, enabling any authenticated user, including those with minimal permissions like Subscribers, to overwrite or delete the site's Google service-account credentials. This vulnerability poses a significant risk as it could lead to unauthorized access or disruption of services relying on these credentials. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate potential exploitation.