Description
The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take over the site. Exploitation requires the SEO Flow by LupsOnline WordPress plugin before 3.0.3 to have been configured, which is its normal operating state.
Published: 2026-09-05
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated Privilege Escalation leading to site takeover
Action: Apply Update
AI Analysis

Impact

The SEO Flow by LupsOnline WordPress plugin before version 3.0.3 fails to validate credentials supplied with its API requests. Unauthenticated users can receive an administrator session, enabling full control of the WordPress site. This is a direct failure to verify authentication tokens, compromising confidentiality, integrity, and availability.

Affected Systems

WordPress sites using the SEO Flow by LupsOnline plugin in versions 3.0.0 through 3.0.2 that have been configured in the normal operating state. The flaw is exploitable only when the plugin is installed and configured.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.8, indicating critical severity, while the EPSS score is less than 1%, indicating a low but non‑zero probability of exploitation. Attackers must send API requests with missing or incorrect credentials to a plugin that is installed and configured; the plugin does not reject unauthorized requests. Because no special access or knowledge of the site is required beyond the normal operation of the plugin, the risk is significant for any site running the vulnerable plugin.

Generated by OpenCVE AI on September 6, 2026 at 15:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the SEO Flow by LupsOnline WordPress plugin to version 3.0.3 or later where credential validation is enforced
  • If upgrading is not immediately possible, disable or remove the plugin’s API key functionality until a patch is applied
  • Audit site configurations to ensure no accidental exposure of API endpoints and implement web‑application firewall rules to block unauthenticated API access

Generated by OpenCVE AI on September 6, 2026 at 15:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 06 Sep 2026 13:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-287

Sun, 06 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sat, 05 Sep 2026 07:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-287

Sat, 05 Sep 2026 06:30:00 +0000

Type Values Removed Values Added
Description The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take over the site. Exploitation requires the SEO Flow by LupsOnline WordPress plugin before 3.0.3 to have been configured, which is its normal operating state.
Title SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation via API Key Authentication
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-09-06T10:40:36.492Z

Reserved: 2026-08-24T11:38:36.046Z

Link: CVE-2026-78362

cve-icon Vulnrichment

Updated: 2026-09-06T10:31:58.204Z

cve-icon NVD

Status : Deferred

Published: 2026-09-05T07:17:12.487

Modified: 2026-09-08T19:09:21.310

Link: CVE-2026-78362

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-06T15:15:07Z

Weaknesses
  • CWE-269

    Improper Privilege Management