TI-2021-07029 Aliases CVE-2021-24747 GHSA-9p7p-4ghr-x9cx

SEO Booster < 3.8 - Admin+ SQL Injection

LOW 35CWE-89Published 2021-12-13 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

The SEO Booster WordPress plugin before 3.8 allows for authenticated SQL injection via the "fn_my_ajaxified_dataloader_ajax" AJAX request as the $_REQUEST['order'][0]['dir'] parameter is not properly escaped leading to blind and error-based SQL injections.

Why it matters now

EPSS 0.01546 75th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed SEO Booster (Unknown): 3.8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	SEO Booster	3.8 to before 3.8	3.8	Patch available	CNA

SEO Booster VendorUnknown Affected 3.8 to before 3.8 Fixed in 3.8 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:cleverplugins:seo_booster::::::wordpress::*	before 3.8	Vulnerable	cleverplugins

cpe:2.3:a:cleverplugins:seo_booster:*:*:*:*:*:wordpress:*:* Versions before 3.8 Vulnerable ·cleverplugins

Remediation

Fix · CNA SEO Booster (Unknown) Fixed in 3.8

Timeline

2026-10-02 Threatist record created from CVE-2021-24747
2026-10-03 Alias added: GHSA-9p7p-4ghr-x9cx

References

Exploit 1

https://wpscan.com/vulnerability/40849d93-8949-4bd0-b60e-c0330b385fea

Patch 1

https://plugins.trac.wordpress.org/changeset/2637115

TI-2024-21333 WordPress SEO Booster plugin <= 3.8.9 - Cross Site Request Forgery (CSRF) vulnerability CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences