What is the CVSS score of CVE-2025-15285?

CVE-2025-15285 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2025-15285?

The SEO Flow by LupsOnline WordPress plugin contains a critical authorization flaw allowing attackers to modify blog and category authentication settings without proper permissions.

How to fix or mitigate CVE-2025-15285?

Within 24 hours: Identify all WordPress instances using SEO Flow by LupsOnline plugin version 2.2.1 or earlier and document affected systems. Within 7 days: Disable the plugin on all affected installations as a temporary measure, or implement strict access controls limiting who can modify authentication settings. Within 30 days: Monitor vendor communications for a security patch; contact LupsOnline for remediation timeline and plan migration to an alternative SEO plugin if necessary.

WordPress CVE-2025-15285

HIGH

Missing Authorization (CWE-862)

2026-02-04 security@wordfence.com

WordPress Authentication Bypass

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 04, 2026 - 09:15 nvd

HIGH 7.5

DescriptionCVE.org

The SEO Flow by LupsOnline plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the checkBlogAuthentication() and checkCategoryAuthentication() functions in all versions up to, and including, 2.2.1. These authorization functions only implement basic API key authentication but fail to implement WordPress capability checks. This makes it possible for unauthenticated attackers to create, modify, and delete blog posts and categories.

AnalysisAI

Technical ContextAI

Classified as CWE-862 (Missing Authorization). Affects SEO Flow by LupsOnline (WordPress plugin). The SEO Flow by LupsOnline plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the checkBlogAuthentication() and checkCategoryAuthentication() functions in all versions up to, and including, 2.2.1. These authorization functions only implement basic API key authentication but fail to implement WordPress capability checks. This makes it possible for unauthenticated attackers to create, modify, and delete blog posts and categories.