The SEO Flow by LupsOnline plugin contains missing capability checks in its checkBlogAuthentication() and checkCategoryAuthentication() functions for versions up to and including 2.2.1. These functions rely solely on a basic API key and do not enforce WordPress capability checks, allowing attackers without authentication to create, modify, or delete blog posts and categories. This compromise of content integrity can be used for defacement, misinformation, or injection of malicious content into the website.

All installations of the SEO Flow by LupsOnline plugin for WordPress released through version 2.2.1 are affected. The vulnerability arises from the plugin’s authentication functions and is present in every build up to that point, regardless of the WordPress version or host configuration.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests that the likelihood of exploitation is currently low. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is via unauthenticated HTTP requests to the plugin’s API endpoints, with no additional privileges or nonces required. Successful exploitation would grant an attacker full control over the site’s content, with potential impacts on confidentiality, integrity, and availability of published material.