Search Atlas SEO < 2.6.12 - Subscriber+ Google Indexing API Access
Priority MEDIUM 58CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-862.
Summary
The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX handlers, allowing any authenticated user such as a Subscriber to invoke the site's Google Indexing API integration, submitting or removing the site's URLs from Google's index and consuming its indexing quota.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00287 21st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Search Atlas SEO (Unknown): 2.6.12
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Search Atlas SEO | before 2.6.12 | 2.6.12 | Patch available | CNA |
- Search Atlas SEO VendorUnknown Affected before 2.6.12 Fixed in 2.6.12 Patch available CNA
Remediation
- Fix · CNA Search Atlas SEO (Unknown) Fixed in 2.6.12
Timeline
- 2026-10-02 Threatist record created from CVE-2026-15252
- 2026-10-03 Alias added: GHSA-4cg6-5xq4-m2fc
References
Sources
- CVE-2026-15252 · CVE Program
- CVE-2026-15252 · NVD
- FIRST EPSS
- GHSA-4cg6-5xq4-m2fc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences