Log in Start free

Vulnerability · Published Sep 19, 2026 · Assigned by Wordfence

CVE-2026-15946Search Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Whitelabel Password Modification via handle_whitelabel_password_early Function

Medium 4.3

In plain English

A medium-severity missing authorization in Search Atlas SEO – OTTO AI SEO Automation for WordPress from shahrukhlinkgraph. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.4%top 65.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.23. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the whitelabel settings password to an attacker-controlled value, enabling them to unlock whitelabel-protected admin settings tabs including whitelabel, general, and advanced configuration.

Affected products (as reported)

VendorProductVersions
shahrukhlinkgraph Search Atlas SEO – OTTO AI SEO Automation for WordPress 0 – through 2.6.23

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References