The vulnerability causes the SEO Flow by LupsOnline WordPress plugin to accept API requests without verifying the supplied credentials. Users who are not authenticated can receive an administrator session, allowing them to perform any action that the administrator is permitted to do, including posting content, changing settings, and compromising the entire site. The flaw is a direct failure to validate authentication tokens, which compromises confidentiality, integrity, and availability of the WordPress installation.

WordPress sites using the SEO Flow by LupsOnline plugin in versions 3.0.0 through 3.0.2. The plugin must have been configured with administrator credentials to be affected; this is the normal operating state of the plugin.

The vulnerability is category 9 on the common vulnerability scoring system for privilege escalation, and its exploitability is high when the plugin is installed and configured, which is typical. No official exploit probability metric is available, and the vulnerability is not yet in the CISA KEV catalog. The attack path is straightforward—an attacker simply calls the plugin’s API endpoint with a bad or missing key, and the plugin fails to reject the request. Because the attack requires no specialized access or knowledge of the site, the risk is significant for any site running the vulnerable plugin.