Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-78362: SEO Flow plugin lets unauthenticated users act as admin
CVE-2026-78362 · published 1 month ago
Summary
The SEO Flow plugin for WordPress (versions before 3.0.3) does not properly check the credentials sent with its API calls. This allows anyone on the internet to impersonate the site administrator who set up the plugin and gain full control of the website. Update the plugin to version 3.0.3 or later, or remove it if you cannot upgrade.
What to do
- Update unknown seo flow by lupsonline to version 3.0.3 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | seo flow by lupsonline | < 3.0.3 |
Original advisory text
The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator ...
The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take over the site. Exploitation requires the SEO Flow by LupsOnline WordPress plugin before 3.0.3 to have been configured, which is its normal operating state.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-269Improper Privilege Management
Timeline
Published5 Sep 2026
Updated11 Oct 2026
First seen5 Sep 2026
Track software like this
Free during beta