CVE-2026-78362 — SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation via API Key Authentication

CVE-2026-78362

SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation via API Key Authentication PUBLISHED

Description (CNA)

The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take over the site. Exploitation requires the SEO Flow by LupsOnline WordPress plugin before 3.0.3 to have been configured, which is its normal operating state.

Affected (CNA)

Vendor / product	Versions
Unknown / SEO Flow by LupsOnline	affected 3.0.0 before 3.0.3

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/0833424b-1231-4a48-be90-13fe4edc60c9/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.