The Search Atlas SEO WordPress plugin before version 2.6.12 fails to perform a capability or nonce check in one of its AJAX handlers. As a result, any authenticated user—such as a site subscriber—can trigger the plugin’s integration with the Google Indexing API. This allows the user to submit or remove the site’s URLs from Google’s index and consume the site's allotted indexing quota without proper authorization. The impact is that an attacker could de‑index the site or exhaust Google’s free quota, adversely affecting search visibility and potentially redirecting search traffic.

WordPress sites running the Search Atlas SEO plugin with a version older than 2.6.12. The vulnerability is mitigated by updating to v2.6.12 or later, which adds the missing capability check. The plugin is distributed by an unknown author and is available through the WordPress plugin repository.

The CVSS score of 5.4 indicates moderate severity. The EPSS score of less than 1% points to a very low chance that an exploit has been observed in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be logged in to the site with at least the subscriber role. Attackers can perform the malicious request directly via AJAX endpoints over the network, so protection through network segmentation or WAF rules may reduce the risk. The lack of a nonce or capability check means the privilege escalation is straightforward for authenticated users.