CVE-2026-1667 cifi CVE debrief

Who should care

Users of the SEO Plugin by Squirrly SEO for WordPress, particularly those with versions up to and including 14.0.0, should be aware of this vulnerability. The vulnerability has a high CVSS score of 7.2, indicating a significant potential impact on affected systems. Affected operators, platforms, and security teams should review the vendor's advisory and take necessary actions to mitigate the vulnerability.

Technical summary

The vulnerability is caused by a leak of an API token and insufficient input sanitization and output escaping in the SEO Plugin by Squirrly SEO plugin for WordPress. This allows unauthenticated attackers to create arbitrary posts and, if the Advanced Custom Fields plugin is installed and activated, inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability affects all versions up to, and including, 14.0.0 of the plugin.

Defensive priority

High priority due to the high CVSS score of 7.2 and the potential for significant impact.

Recommended defensive actions

• Update the SEO Plugin by Squirrly SEO to a version beyond 14.0.0.
• Verify that the Advanced Custom Fields plugin is not installed and activated if not needed.
• Monitor for suspicious post creation and script injection activities.
• Implement additional security measures such as Web Application Firewall (WAF) rules to detect and prevent exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

Evidence is based on the CVE record and NVD detail provided. Further verification is recommended. The vulnerability has a high CVSS score of 7.2, indicating a significant potential impact. Users should verify the affected versions and configurations, and review the vendor's advisory for specific guidance. Additional sources may provide further insights into the vulnerability and its potential effects.

Official resources