Read the docs
TI-2026-54497 Aliases CVE-2026-78362GHSA-rp68-vhcr-9v26

SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation via API Key Authentication

Priority MEDIUM 49CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-269.

Summary

The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take over the site. Exploitation requires the SEO Flow by LupsOnline WordPress plugin before 3.0.3 to have been configured, which is its normal operating state.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00498 42nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed SEO Flow by LupsOnline (Unknown): 3.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownSEO Flow by LupsOnline3.0.0 to before 3.0.33.0.3Patch availableCNA
  • SEO Flow by LupsOnline VendorUnknown Affected 3.0.0 to before 3.0.3 Fixed in 3.0.3 Patch available CNA

Remediation

  • Fix · CNA SEO Flow by LupsOnline (Unknown) Fixed in 3.0.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-78362
  2. 2026-10-03 Alias added: GHSA-rp68-vhcr-9v26

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences