Vulnerability · Published Sep 5, 2026 · Assigned by WPScan

CVE-2026-78362SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation via API Key Authentication

Critical 9.8

In plain English

A critical-severity privilege mismanagement in SEO Flow by LupsOnline from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.5%top 57.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take over the site. Exploitation requires the SEO Flow by LupsOnline WordPress plugin before 3.0.3 to have been configured, which is its normal operating state.

Affected products (as reported)

Vendor	Product	Versions
Unknown	SEO Flow by LupsOnline	3.0.0 – before 3.0.3

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/0833424b-1231-4a48-be90-13fe4edc60c9/ exploit, vdb-entry, technical-description