Search Atlas SEO < 2.6.12 – Subscriber+ Google Indexing API Access | CVE 2026-15252

Description

The plugin does not perform a capability or nonce check in one of its AJAX handlers, allowing any authenticated user such as a Subscriber to invoke the site's Google Indexing API integration, submitting or removing the site's URLs from Google's index and consuming its indexing quota.

Proof of Concept

Prerequisites:
- Search Atlas SEO (metasync) <= 2.6.11 active, with the Google Indexing integration configured (a valid Google service-account JSON stored by the plugin). This is the plugin's core feature, so it is the expected setup on a site using instant indexing.
- The attacker holds any logged-in account, e.g. a Subscriber. The AJAX action requires login (no nopriv variant); an unauthenticated request returns HTTP 400.

Steps:
1. Log in as the Subscriber and save the session cookies.
2. Send the indexing request (action=remove maps internally to a URL removal):

curl -s -b cookies.txt "https://victim.example/wp-admin/admin-ajax.php" \
  --data 'action=metasync_send_giapi&metasync_giapi_url=https%3A%2F%2Fvictim.example%2F&metasync_giapi_action=remove'

3. Response: HTTP 200 with a JSON body from the Google Indexing API, e.g. {"urlNotificationMetadata":{"url":"...","latestRemove":{"type":"URL_DELETED"}}}.

Result: with no capability or nonce check, the Subscriber drove the site's Google Indexing integration using the site's stored service-account credentials, requesting removal of a URL from the site's Google index and consuming the site's indexing quota. Controls: an unauthenticated request returns HTTP 400; a guarded sibling handler in the same class returns 403.