Exploitation Research Plan: CVE-2026-7624 (Squirrly SEO)

1. Vulnerability Summary

The SEO Plugin by Squirrly SEO (up to version 12.4.16) is vulnerable to a missing authorization check. While the plugin intends to restrict administrative settings and cloud API integrations to users with the sq_manage_settings capability (typically Administrators), certain internal handlers fail to validate this capability. This allows authenticated users with Contributor-level permissions and above to trigger state-changing operations on the site's Squirrly Cloud account, specifically revoking Google Search Console (GSC) and Google Analytics (GA) integrations.

2. Attack Vector Analysis

• Target Endpoint: wp-admin/admin-ajax.php
• Vulnerable Action: sq_ajax_admin (inferred based on plugin architecture) or a related Squirrly AJAX dispatcher.
• Payload Parameter: sm (Squirrly Method) or action parameter used to specify the API route (e.g., api/gsc/revoke).
• Authentication: Required (Contributor-level or higher).
• Authorization: Missing check for sq_manage_settings capability in the AJAX handler.
• Nonce Requirement: Likely requires the sq_nonce generated for Squirrly admin operations.

3. Code Flow

1. Entry Point: The user sends a POST request to admin-ajax.php.
2. Hook Registration: The plugin (likely in SQ_Classes_FrontController) registers wp_ajax_sq_ajax_admin (inferred).
3. Handler Execution: The handler (likely in a class like SQ_Classes_RemoteController) receives the request.
4. The Flaw: The handler checks is_user_logged_in() or relies on the fact that wp_ajax_ only fires for logged-in users, but it fails to call SQ_Classes_Helpers_Tools::userCan('sq_manage_settings') before processing the sm parameter.
5. Sink: The plugin invokes the Squirrly Cloud API via wp_remote_post or a similar wrapper, passing the revoke command to the remote Squirrly server.

4. Nonce Acquisition Strategy

Squirrly SEO localizes its configuration and nonces for the WordPress dashboard. Even Contributor-level users can access the dashboard (/wp-admin/), allowing them to extract the nonce from the page source.

• Trigger: The nonce is usually localized via wp_localize_script and appears on most Squirrly-related admin pages, or even the main dashboard if the Squirrly "Dashboard" widget is active.
• JS Variable: sq_query (inferred) or sq_config.
• Nonce Key: nonce.
• Extraction Steps:
  1. Login as a Contributor user.
  2. Navigate to /wp-admin/index.php.
  3. Use browser_eval to extract the nonce: browser_eval("window.sq_query?.nonce || window.sq_config?.nonce").

5. Test Data Setup

1. Install Plugin: Squirrly SEO version 12.4.16.
2. Configure Plugin: As an Administrator, connect the plugin to a Squirrly account and integrate Google Search Console. (Note: For PoC purposes, the API call is the exploit; physical GSC connection may be mocked if the API returns a success/fail response).
3. Create Attacker: Create a user with the contributor role.

6. Exploitation Strategy

The goal is to trigger the api/gsc/revoke operation using the Contributor's session.

HTTP Request (Playwright/http_request)

• URL: http://[TARGET]/wp-admin/admin-ajax.php
• Method: POST
• Headers:
  • Content-Type: application/x-www-form-urlencoded
  • Cookie: [Contributor Session Cookies]
• Body:

  action=sq_ajax_admin
  &sm=api/gsc/revoke
  &sq_nonce=[EXTRACTED_NONCE]
  

(Note: sq_ajax_admin and sm are inferred based on the plugin's historical routing patterns and the "api/gsc/revoke" string mentioned in the vulnerability description.)

7. Expected Results

• HTTP Response: A 200 OK response, likely containing a JSON body such as {"success": true} or a message indicating the GSC integration has been revoked.
• Side Effect: The site's connection to Google Search Console via Squirrly Cloud is terminated.

8. Verification Steps

1. Check Plugin State: Use WP-CLI to check if the GSC token or connection status has changed in the Squirrly options.
   • wp option get sq_options
2. Dashboard Check: Log in as an Administrator and navigate to the Squirrly "GSC" settings page. The integration should now appear as "Disconnected" or "Not Setup."
3. Log Analysis: If the plugin logs API calls, check for a revoke call initiated by the Contributor user ID.

9. Alternative Approaches

If sq_ajax_admin is not the correct action:

• Search the source code for the string api/gsc/revoke to identify which controller handles this route.
• Look for any add_action('wp_ajax_...', ...) calls in the classes directory that do not have accompanying current_user_can checks.
• Check the REST API routes via wp-json/squirrly/v1/... (inferred) if the plugin has transitioned to REST handlers.